update console version (#427)

Signed-off-by: bitliu <bitliu@tencent.com>

.github/workflows/build-and-test.yaml

@@ -107,7 +107,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
 
-  ingress-conformance-test:
+  higress-conformance-test:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
@@ -141,10 +141,10 @@ jobs:
           
     - run: git stash # restore patch
 
-    - name: "Run Ingress Conformance Tests"
-      run: GOPROXY="https://proxy.golang.org,direct" make ingress-conformance-test
+    - name: "Run Higress E2E Conformance Tests"
+      run: GOPROXY="https://proxy.golang.org,direct" make higress-conformance-test
       
-  ingress-wasmplugin-test:
+  higress-wasmplugin-test:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
@@ -179,10 +179,10 @@ jobs:
     - run: git stash # restore patch
 
     - name: "Run Ingress WasmPlugins Tests"
-      run: GOPROXY="https://proxy.golang.org,direct" make ingress-wasmplugin-test
+      run: GOPROXY="https://proxy.golang.org,direct" make higress-wasmplugin-test
 
   publish:
     runs-on: ubuntu-latest
-    needs: [ingress-conformance-test,gateway-conformance-test,ingress-wasmplugin-test]
+    needs: [higress-conformance-test,gateway-conformance-test,higress-wasmplugin-test]
     steps:
     - uses: actions/checkout@v3

.github/workflows/build-image-and-push.yaml

@@ -0,0 +1,144 @@
+name: Build Docker Images and Push to Image Registry
+
+on:
+  push:
+    tags:
+    - "v*.*.*"
+  workflow_dispatch: ~
+
+jobs:
+  build-controller-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-controller
+    env:
+      CONTROLLER_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      CONTROLLER_IMAGE_NAME: ${{ vars.CONTROLLER_IMAGE_NAME || 'higress/higress' }}
+    steps:
+      - name: "Checkout ${{ github.ref }}"
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 1
+
+      - name: "Setup Go"
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+
+      - name: Setup Golang Caches
+        uses: actions/cache@v3
+        with:
+          path: |-
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-go
+
+      - name: Setup Submodule Caches
+        uses: actions/cache@v3
+        with:
+          path: |-
+            envoy
+            istio
+            external
+            .git/modules
+          key: ${{ runner.os }}-submodules-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-submodules
+
+      - name: Calculate Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.CONTROLLER_IMAGE_REGISTRY }}/${{ env.CONTROLLER_IMAGE_NAME }}
+          tags: |
+            type=sha
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.CONTROLLER_IMAGE_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build Docker Image and Push
+        run: |
+          GOPROXY="https://proxy.golang.org,direct" make docker-build
+          BUILT_IMAGE="higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/higress"
+          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
+          for image in ${IMAGES[@]}; do
+            echo "Image: $image"
+            docker tag $BUILT_IMAGE:$GITHUB_SHA $image
+            docker push $image
+          done
+
+  build-pilot-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-pilot
+    env:
+      PILOT_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      PILOT_IMAGE_NAME: ${{ vars.PILOT_IMAGE_NAME || 'higress/pilot' }}
+    steps:
+      - name: "Checkout ${{ github.ref }}"
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 1
+
+      - name: "Setup Go"
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19
+
+      - name: Setup Golang Caches
+        uses: actions/cache@v3
+        with:
+          path: |-
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-go
+
+      - name: Setup Submodule Caches
+        uses: actions/cache@v3
+        with:
+          path: |-
+            envoy
+            istio
+            external
+            .git/modules
+          key: ${{ runner.os }}-submodules-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-submodules
+
+      - name: Calculate Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ${{ env.PILOT_IMAGE_REGISTRY }}/${{ env.PILOT_IMAGE_NAME }}
+          tags: |
+            type=sha
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.PILOT_IMAGE_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build Docker Image and Push
+        run: |
+          sudo GOPROXY="https://proxy.golang.org,direct" make build-istio
+          BUILT_IMAGE="higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/pilot"
+          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
+          for image in ${IMAGES[@]}; do
+            echo "Image: $image"
+            docker tag $BUILT_IMAGE:$GITHUB_SHA $image
+            docker push $image
+          done

.github/workflows/deploy-standalone-to-oss.yaml

@@ -0,0 +1,37 @@
+name: Deploy Standalone to OSS
+
+on:
+  push:
+    tags:
+    - "v*.*.*"
+  workflow_dispatch: ~
+
+jobs:
+  deploy-to-oss:
+    runs-on: ubuntu-latest
+    environment:
+      name: oss
+    steps:
+      # Step 1
+      - name: Checkout
+        uses: actions/checkout@v3
+      # Step 2
+      - id: package
+        name: Prepare Standalone Package
+        run: |
+          mkdir ./artifact
+          cp ./tools/get-higress.sh ./artifact
+          LOCAL_RELEASE_URL="https://github.com/higress-group/higress-standalone/releases"
+          VERSION=$(curl -Ls $LOCAL_RELEASE_URL | grep 'href="/higress-group/higress-standalone/releases/tag/v[0-9]*.[0-9]*.[0-9]*\"' | sed -E 's/.*\/higress-group\/higress-standalone\/releases\/tag\/(v[0-9\.]+)".*/\1/g' | head -1)
+          DOWNLOAD_URL="https://github.com/higress-group/higress-standalone/archive/refs/tags/${VERSION}.tar.gz"
+          curl -SsL "$DOWNLOAD_URL" -o "./artifact/higress-${VERSION}.tar.gz"
+          echo -n "$VERSION" > ./artifact/VERSION
+          echo "Version=$VERSION"
+      # Step 3
+      - name: Upload to OSS
+        uses: doggycool/ossutil-github-action@master
+        with:
+          ossArgs: 'cp -r -u ./artifact/ oss://higress-website-cn-hongkong/standalone/'
+          accessKey: ${{ secrets.ACCESS_KEYID }}
+          accessSecret: ${{ secrets.ACCESS_KEYSECRET }}
+          endpoint: oss-cn-hongkong.aliyuncs.com

.github/workflows/deploy-to-oss.yaml

@@ -4,10 +4,13 @@ on:
   push:
     tags:
     - "v*.*.*"
+  workflow_dispatch: ~
 
 jobs:
   deploy-to-oss:
     runs-on: ubuntu-latest
+    environment:
+      name: oss
     steps:
       # Step 1
       - name: Checkout
@@ -38,6 +41,8 @@ jobs:
             helmv3 dependency build helm/higress
             helmv3 package helm/higress --debug --app-version ${{steps.calc-version.outputs.version}} --version ${{steps.calc-version.outputs.version}} -d ./artifact
             helmv3 repo index --url https://higress.io/helm-charts/ --merge ./artifact/index.yaml ./artifact
+            cp ./artifact/index.yaml ./artifact/cn-index.yaml
+            sed -i 's/higress\.io/higress\.cn/g' ./artifact/cn-index.yaml
       # Step 5
       - name: Upload to OSS
         uses: doggycool/ossutil-github-action@master

.gitignore

@@ -13,4 +13,5 @@ bazel-testlogs
 bazel-wasm-cpp
 tools/bin/
 helm/**/charts/**.tgz
+target/
 tools/hack/cluster.conf

Makefile.core.mk

@@ -142,8 +142,8 @@ install: pre-install
 	cd helm/higress; helm dependency build
 	helm install higress helm/higress -n higress-system --create-namespace --set 'global.local=true'
 
-ENVOY_LATEST_IMAGE_TAG ?= 1.0.0
-ISTIO_LATEST_IMAGE_TAG ?= 1.0.0
+ENVOY_LATEST_IMAGE_TAG ?= 1.1.0
+ISTIO_LATEST_IMAGE_TAG ?= 1.1.0
 
 install-dev: pre-install
 	helm install higress helm/core -n higress-system --create-namespace --set 'controller.tag=$(TAG)' --set 'gateway.replicas=1' --set 'gateway.tag=$(ENVOY_LATEST_IMAGE_TAG)' --set 'global.local=true'
@@ -199,13 +199,13 @@ include tools/lint.mk
 .PHONY: gateway-conformance-test
 gateway-conformance-test:
 
-# ingress-conformance-test runs ingress api conformance tests.
-.PHONY: ingress-conformance-test
-ingress-conformance-test: $(tools/kind) delete-cluster create-cluster docker-build kube-load-image install-dev run-ingress-e2e-test delete-cluster
+# higress-conformance-test runs ingress api conformance tests.
+.PHONY: higress-conformance-test
+higress-conformance-test: $(tools/kind) delete-cluster create-cluster docker-build kube-load-image install-dev run-higress-e2e-test delete-cluster
 
-# ingress-wasmplugin-test runs ingress wasmplugin tests.
-.PHONY: ingress-wasmplugin-test
-ingress-wasmplugin-test: $(tools/kind) delete-cluster create-cluster docker-build kube-load-image install-dev-wasmplugin run-ingress-e2e-test-wasmplugin delete-cluster
+# higress-wasmplugin-test runs ingress wasmplugin tests.
+.PHONY: higress-wasmplugin-test
+higress-wasmplugin-test: $(tools/kind) delete-cluster create-cluster docker-build kube-load-image install-dev-wasmplugin run-higress-e2e-test-wasmplugin delete-cluster
 
 # create-cluster creates a kube cluster with kind.
 .PHONY: create-cluster
@@ -218,26 +218,33 @@ delete-cluster: $(tools/kind) ## Delete kind cluster.
 	$(tools/kind) delete cluster --name higress
 
 # kube-load-image loads a local built docker image into kube cluster.
+# dubbo-provider-demo和nacos-standlone-rc3的镜像已经上传到阿里云镜像库，第一次需要先拉到本地
+# docker pull registry.cn-hangzhou.aliyuncs.com/hinsteny/dubbo-provider-demo:0.0.1
+# docker pull registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3:1.0.0-RC3
 .PHONY: kube-load-image
 kube-load-image: $(tools/kind) ## Install the Higress image to a kind cluster using the provided $IMAGE and $TAG.
 	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/higress $(TAG)
+	tools/hack/docker-pull-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/dubbo-provider-demo 0.0.1
+	tools/hack/docker-pull-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3 1.0.0-RC3
+	tools/hack/kind-load-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/dubbo-provider-demo 0.0.1
+	tools/hack/kind-load-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3 1.0.0-RC3
 
-# run-ingress-e2e-test starts to run ingress e2e tests.
-.PHONY: run-ingress-e2e-test
-run-ingress-e2e-test:
+# run-higress-e2e-test starts to run ingress e2e tests.
+.PHONY: run-higress-e2e-test
+run-higress-e2e-test:
 	@echo -e "\n\033[36mRunning higress conformance tests...\033[0m"
 	@echo -e "\n\033[36mWaiting higress-controller to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/ingress/e2e_test.go --ingress-class=higress --debug=true
+	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true
 
-# run-ingress-e2e-test starts to run ingress e2e tests.
-.PHONY: run-ingress-e2e-test-wasmplugin
-run-ingress-e2e-test-wasmplugin:
+# run-higress-e2e-test starts to run ingress e2e tests.
+.PHONY: run-higress-e2e-test-wasmplugin
+run-higress-e2e-test-wasmplugin:
 	@echo -e "\n\033[36mRunning higress conformance tests...\033[0m"
 	@echo -e "\n\033[36mWaiting higress-controller to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/ingress/e2e_test.go -isWasmPluginTest=true --ingress-class=higress --debug=true
+	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true --ingress-class=higress --debug=true

README.md

@@ -125,7 +125,7 @@ Higress 是基于阿里内部两年多的 Envoy Gateway 实践沉淀，以开源
 
 社区交流群: 
 
-![image](https://img.alicdn.com/imgextra/i1/O1CN01d7LmWu1rMB71rfRhA_!!6000000005616-2-tps-720-405.png)
+![image](https://img.alicdn.com/imgextra/i1/O1CN01KWonlE1DkpqaYVTiC_!!6000000000255-0-tps-720-405.jpg)
 
 
 开发者群：

VERSION

@@ -1 +1 @@
-v1.0.1
+v1.1.0

api/kubernetes/customresourcedefinitions.gen.yaml

@@ -104,6 +104,88 @@ spec:
     subresources:
       status: {}
 
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
+  name: http2rpcs.networking.higress.io
+spec:
+  group: networking.higress.io
+  names:
+    categories:
+    - higress-io
+    kind: Http2Rpc
+    listKind: Http2RpcList
+    plural: http2rpcs
+    singular: http2rpc
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          spec:
+            oneOf:
+            - not:
+                anyOf:
+                - required:
+                  - dubbo
+                - required:
+                  - grpc
+            - required:
+              - dubbo
+            - required:
+              - grpc
+            properties:
+              dubbo:
+                properties:
+                  group:
+                    type: string
+                  methods:
+                    items:
+                      properties:
+                        headersAttach:
+                          type: string
+                        httpMethods:
+                          items:
+                            type: string
+                          type: array
+                        httpPath:
+                          type: string
+                        params:
+                          items:
+                            properties:
+                              paramKey:
+                                type: string
+                              paramSource:
+                                type: string
+                              paramType:
+                                type: string
+                            type: object
+                          type: array
+                        serviceMethod:
+                          type: string
+                      type: object
+                    type: array
+                  service:
+                    type: string
+                  version:
+                    type: string
+                type: object
+              grpc:
+                type: object
+            type: object
+          status:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition

api/networking/v1/http_2_rpc.proto

@@ -0,0 +1,74 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//  
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//  
+//      http://www.apache.org/licenses/LICENSE-2.0
+//  
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+import "google/api/field_behavior.proto";
+
+// $schema: higress.networking.v1.Http2Rpc
+// $title: Http2Rpc
+// $description: Configuration affecting service discovery from multi registries
+// $mode: none
+
+package higress.networking.v1;
+
+option go_package = "github.com/alibaba/higress/api/networking/v1";
+
+// <!-- crd generation tags
+// +cue-gen:Http2Rpc:groupName:networking.higress.io
+// +cue-gen:Http2Rpc:version:v1
+// +cue-gen:Http2Rpc:storageVersion
+// +cue-gen:Http2Rpc:annotations:helm.sh/resource-policy=keep
+// +cue-gen:Http2Rpc:subresource:status
+// +cue-gen:Http2Rpc:scope:Namespaced
+// +cue-gen:Http2Rpc:resource:categories=higress-io,plural=Http2Rpcs
+// +cue-gen:Http2Rpc:preserveUnknownFields:false
+// -->
+//
+// <!-- go code generation tags
+// +kubetype-gen
+// +kubetype-gen:groupVersion=networking.higress.io/v1
+// +genclient
+// +k8s:deepcopy-gen=true
+// -->
+message Http2Rpc {
+  oneof destination {
+    DubboService dubbo = 1;
+    GrpcService  grpc = 2;
+ }
+}
+
+message DubboService {
+  string service = 1 [(google.api.field_behavior) = REQUIRED];
+  string version = 2 [(google.api.field_behavior) = REQUIRED];
+  string group = 3 [(google.api.field_behavior) = OPTIONAL];
+  repeated Method methods = 4 [(google.api.field_behavior) = REQUIRED];
+}
+
+message Method {
+  string service_method = 1 [(google.api.field_behavior) = REQUIRED];
+  string headers_attach = 2 [(google.api.field_behavior) = OPTIONAL];
+  string http_path = 3 [(google.api.field_behavior) = REQUIRED];
+  repeated string http_methods = 4 [(google.api.field_behavior) = REQUIRED];
+  repeated Param params = 5;
+}
+
+message Param {
+  string param_source = 1 [(google.api.field_behavior) = REQUIRED];
+  string param_key = 2 [(google.api.field_behavior) = REQUIRED];
+  string param_type = 3 [(google.api.field_behavior) = REQUIRED];
+}
+
+message GrpcService {
+}

api/networking/v1/http_2_rpc_deepcopy.gen.go

@@ -0,0 +1,121 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: networking/v1/http_2_rpc.proto
+
+package v1
+
+import (
+	fmt "fmt"
+	proto "github.com/gogo/protobuf/proto"
+	_ "istio.io/gogo-genproto/googleapis/google/api"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// DeepCopyInto supports using Http2Rpc within kubernetes types, where deepcopy-gen is used.
+func (in *Http2Rpc) DeepCopyInto(out *Http2Rpc) {
+	p := proto.Clone(in).(*Http2Rpc)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Http2Rpc. Required by controller-gen.
+func (in *Http2Rpc) DeepCopy() *Http2Rpc {
+	if in == nil {
+		return nil
+	}
+	out := new(Http2Rpc)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new Http2Rpc. Required by controller-gen.
+func (in *Http2Rpc) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using DubboService within kubernetes types, where deepcopy-gen is used.
+func (in *DubboService) DeepCopyInto(out *DubboService) {
+	p := proto.Clone(in).(*DubboService)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DubboService. Required by controller-gen.
+func (in *DubboService) DeepCopy() *DubboService {
+	if in == nil {
+		return nil
+	}
+	out := new(DubboService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new DubboService. Required by controller-gen.
+func (in *DubboService) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using Method within kubernetes types, where deepcopy-gen is used.
+func (in *Method) DeepCopyInto(out *Method) {
+	p := proto.Clone(in).(*Method)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Method. Required by controller-gen.
+func (in *Method) DeepCopy() *Method {
+	if in == nil {
+		return nil
+	}
+	out := new(Method)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new Method. Required by controller-gen.
+func (in *Method) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using Param within kubernetes types, where deepcopy-gen is used.
+func (in *Param) DeepCopyInto(out *Param) {
+	p := proto.Clone(in).(*Param)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Param. Required by controller-gen.
+func (in *Param) DeepCopy() *Param {
+	if in == nil {
+		return nil
+	}
+	out := new(Param)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new Param. Required by controller-gen.
+func (in *Param) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using GrpcService within kubernetes types, where deepcopy-gen is used.
+func (in *GrpcService) DeepCopyInto(out *GrpcService) {
+	p := proto.Clone(in).(*GrpcService)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GrpcService. Required by controller-gen.
+func (in *GrpcService) DeepCopy() *GrpcService {
+	if in == nil {
+		return nil
+	}
+	out := new(GrpcService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new GrpcService. Required by controller-gen.
+func (in *GrpcService) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}

api/networking/v1/http_2_rpc_json.gen.go

@@ -0,0 +1,78 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: networking/v1/http_2_rpc.proto
+
+package v1
+
+import (
+	bytes "bytes"
+	fmt "fmt"
+	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
+	proto "github.com/gogo/protobuf/proto"
+	_ "istio.io/gogo-genproto/googleapis/google/api"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// MarshalJSON is a custom marshaler for Http2Rpc
+func (this *Http2Rpc) MarshalJSON() ([]byte, error) {
+	str, err := Http_2RpcMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for Http2Rpc
+func (this *Http2Rpc) UnmarshalJSON(b []byte) error {
+	return Http_2RpcUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for DubboService
+func (this *DubboService) MarshalJSON() ([]byte, error) {
+	str, err := Http_2RpcMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for DubboService
+func (this *DubboService) UnmarshalJSON(b []byte) error {
+	return Http_2RpcUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for Method
+func (this *Method) MarshalJSON() ([]byte, error) {
+	str, err := Http_2RpcMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for Method
+func (this *Method) UnmarshalJSON(b []byte) error {
+	return Http_2RpcUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for Param
+func (this *Param) MarshalJSON() ([]byte, error) {
+	str, err := Http_2RpcMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for Param
+func (this *Param) UnmarshalJSON(b []byte) error {
+	return Http_2RpcUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for GrpcService
+func (this *GrpcService) MarshalJSON() ([]byte, error) {
+	str, err := Http_2RpcMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for GrpcService
+func (this *GrpcService) UnmarshalJSON(b []byte) error {
+	return Http_2RpcUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+var (
+	Http_2RpcMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
+	Http_2RpcUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
+)

client/pkg/apis/networking/v1/register.gen.go

@@ -41,6 +41,8 @@ func Resource(resource string) schema.GroupResource {
 
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Http2Rpc{},
+		&Http2RpcList{},
 		&McpBridge{},
 		&McpBridgeList{},
 	)

client/pkg/apis/networking/v1/types.gen.go

@@ -25,6 +25,48 @@ import (
 // please upgrade the proto package
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
+// <!-- crd generation tags
+// +cue-gen:Http2Rpc:groupName:networking.higress.io
+// +cue-gen:Http2Rpc:version:v1
+// +cue-gen:Http2Rpc:storageVersion
+// +cue-gen:Http2Rpc:annotations:helm.sh/resource-policy=keep
+// +cue-gen:Http2Rpc:subresource:status
+// +cue-gen:Http2Rpc:scope:Namespaced
+// +cue-gen:Http2Rpc:resource:categories=higress-io,plural=Http2Rpcs
+// +cue-gen:Http2Rpc:preserveUnknownFields:false
+// -->
+//
+// <!-- go code generation tags
+// +kubetype-gen
+// +kubetype-gen:groupVersion=networking.higress.io/v1
+// +genclient
+// +k8s:deepcopy-gen=true
+// -->
+type Http2Rpc struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Spec defines the implementation of this definition.
+	// +optional
+	Spec networkingv1.Http2Rpc `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
+
+	Status v1alpha1.IstioStatus `json:"status"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Http2RpcList is a collection of Http2Rpcs.
+type Http2RpcList struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []Http2Rpc `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// please upgrade the proto package
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
 // <!-- crd generation tags
 // +cue-gen:McpBridge:groupName:networking.higress.io
 // +cue-gen:McpBridge:version:v1

client/pkg/apis/networking/v1/zz_generated.deepcopy.gen.go

@@ -23,6 +23,67 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Http2Rpc) DeepCopyInto(out *Http2Rpc) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Http2Rpc.
+func (in *Http2Rpc) DeepCopy() *Http2Rpc {
+	if in == nil {
+		return nil
+	}
+	out := new(Http2Rpc)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Http2Rpc) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Http2RpcList) DeepCopyInto(out *Http2RpcList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Http2Rpc, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Http2RpcList.
+func (in *Http2RpcList) DeepCopy() *Http2RpcList {
+	if in == nil {
+		return nil
+	}
+	out := new(Http2RpcList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Http2RpcList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *McpBridge) DeepCopyInto(out *McpBridge) {
 	*out = *in

client/pkg/clientset/versioned/typed/networking/v1/fake/fake_http2rpc.gen.go

@@ -0,0 +1,140 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeHttp2Rpcs implements Http2RpcInterface
+type FakeHttp2Rpcs struct {
+	Fake *FakeNetworkingV1
+	ns   string
+}
+
+var http2rpcsResource = schema.GroupVersionResource{Group: "networking.higress.io", Version: "v1", Resource: "http2rpcs"}
+
+var http2rpcsKind = schema.GroupVersionKind{Group: "networking.higress.io", Version: "v1", Kind: "Http2Rpc"}
+
+// Get takes name of the http2Rpc, and returns the corresponding http2Rpc object, and an error if there is any.
+func (c *FakeHttp2Rpcs) Get(ctx context.Context, name string, options v1.GetOptions) (result *networkingv1.Http2Rpc, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(http2rpcsResource, c.ns, name), &networkingv1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*networkingv1.Http2Rpc), err
+}
+
+// List takes label and field selectors, and returns the list of Http2Rpcs that match those selectors.
+func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *networkingv1.Http2RpcList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(http2rpcsResource, http2rpcsKind, c.ns, opts), &networkingv1.Http2RpcList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &networkingv1.Http2RpcList{ListMeta: obj.(*networkingv1.Http2RpcList).ListMeta}
+	for _, item := range obj.(*networkingv1.Http2RpcList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested http2Rpcs.
+func (c *FakeHttp2Rpcs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(http2rpcsResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a http2Rpc and creates it.  Returns the server's representation of the http2Rpc, and an error, if there is any.
+func (c *FakeHttp2Rpcs) Create(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.CreateOptions) (result *networkingv1.Http2Rpc, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(http2rpcsResource, c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*networkingv1.Http2Rpc), err
+}
+
+// Update takes the representation of a http2Rpc and updates it. Returns the server's representation of the http2Rpc, and an error, if there is any.
+func (c *FakeHttp2Rpcs) Update(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.UpdateOptions) (result *networkingv1.Http2Rpc, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(http2rpcsResource, c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*networkingv1.Http2Rpc), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeHttp2Rpcs) UpdateStatus(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.UpdateOptions) (*networkingv1.Http2Rpc, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceAction(http2rpcsResource, "status", c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*networkingv1.Http2Rpc), err
+}
+
+// Delete takes name of the http2Rpc and deletes it. Returns an error if one occurs.
+func (c *FakeHttp2Rpcs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteAction(http2rpcsResource, c.ns, name), &networkingv1.Http2Rpc{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeHttp2Rpcs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(http2rpcsResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &networkingv1.Http2RpcList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched http2Rpc.
+func (c *FakeHttp2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *networkingv1.Http2Rpc, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, name, pt, data, subresources...), &networkingv1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*networkingv1.Http2Rpc), err
+}

client/pkg/clientset/versioned/typed/networking/v1/fake/fake_networking_client.gen.go

@@ -26,6 +26,10 @@ type FakeNetworkingV1 struct {
 	*testing.Fake
 }
 
+func (c *FakeNetworkingV1) Http2Rpcs(namespace string) v1.Http2RpcInterface {
+	return &FakeHttp2Rpcs{c, namespace}
+}
+
 func (c *FakeNetworkingV1) McpBridges(namespace string) v1.McpBridgeInterface {
 	return &FakeMcpBridges{c, namespace}
 }

client/pkg/clientset/versioned/typed/networking/v1/generated_expansion.gen.go

@@ -16,4 +16,6 @@
 
 package v1
 
+type Http2RpcExpansion interface{}
+
 type McpBridgeExpansion interface{}

client/pkg/clientset/versioned/typed/networking/v1/http2rpc.gen.go

@@ -0,0 +1,193 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	"context"
+	"time"
+
+	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// Http2RpcsGetter has a method to return a Http2RpcInterface.
+// A group's client should implement this interface.
+type Http2RpcsGetter interface {
+	Http2Rpcs(namespace string) Http2RpcInterface
+}
+
+// Http2RpcInterface has methods to work with Http2Rpc resources.
+type Http2RpcInterface interface {
+	Create(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.CreateOptions) (*v1.Http2Rpc, error)
+	Update(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (*v1.Http2Rpc, error)
+	UpdateStatus(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (*v1.Http2Rpc, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*v1.Http2Rpc, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*v1.Http2RpcList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Http2Rpc, err error)
+	Http2RpcExpansion
+}
+
+// http2Rpcs implements Http2RpcInterface
+type http2Rpcs struct {
+	client rest.Interface
+	ns     string
+}
+
+// newHttp2Rpcs returns a Http2Rpcs
+func newHttp2Rpcs(c *NetworkingV1Client, namespace string) *http2Rpcs {
+	return &http2Rpcs{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the http2Rpc, and returns the corresponding http2Rpc object, and an error if there is any.
+func (c *http2Rpcs) Get(ctx context.Context, name string, options metav1.GetOptions) (result *v1.Http2Rpc, err error) {
+	result = &v1.Http2Rpc{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Http2Rpcs that match those selectors.
+func (c *http2Rpcs) List(ctx context.Context, opts metav1.ListOptions) (result *v1.Http2RpcList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1.Http2RpcList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested http2Rpcs.
+func (c *http2Rpcs) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a http2Rpc and creates it.  Returns the server's representation of the http2Rpc, and an error, if there is any.
+func (c *http2Rpcs) Create(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.CreateOptions) (result *v1.Http2Rpc, err error) {
+	result = &v1.Http2Rpc{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(http2Rpc).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a http2Rpc and updates it. Returns the server's representation of the http2Rpc, and an error, if there is any.
+func (c *http2Rpcs) Update(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (result *v1.Http2Rpc, err error) {
+	result = &v1.Http2Rpc{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(http2Rpc.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(http2Rpc).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *http2Rpcs) UpdateStatus(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (result *v1.Http2Rpc, err error) {
+	result = &v1.Http2Rpc{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(http2Rpc.Name).
+		SubResource("status").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(http2Rpc).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the http2Rpc and deletes it. Returns an error if one occurs.
+func (c *http2Rpcs) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *http2Rpcs) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched http2Rpc.
+func (c *http2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Http2Rpc, err error) {
+	result = &v1.Http2Rpc{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/networking_client.gen.go

@@ -24,6 +24,7 @@ import (
 
 type NetworkingV1Interface interface {
 	RESTClient() rest.Interface
+	Http2RpcsGetter
 	McpBridgesGetter
 }
 
@@ -32,6 +33,10 @@ type NetworkingV1Client struct {
 	restClient rest.Interface
 }
 
+func (c *NetworkingV1Client) Http2Rpcs(namespace string) Http2RpcInterface {
+	return newHttp2Rpcs(c, namespace)
+}
+
 func (c *NetworkingV1Client) McpBridges(namespace string) McpBridgeInterface {
 	return newMcpBridges(c, namespace)
 }

client/pkg/informers/externalversions/generic.gen.go

@@ -56,6 +56,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Extensions().V1alpha1().WasmPlugins().Informer()}, nil
 
 		// Group=networking.higress.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("http2rpcs"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Networking().V1().Http2Rpcs().Informer()}, nil
 	case v1.SchemeGroupVersion.WithResource("mcpbridges"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Networking().V1().McpBridges().Informer()}, nil
 

client/pkg/informers/externalversions/networking/v1/http2rpc.gen.go

@@ -0,0 +1,88 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	"context"
+	time "time"
+
+	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	versioned "github.com/alibaba/higress/client/pkg/clientset/versioned"
+	internalinterfaces "github.com/alibaba/higress/client/pkg/informers/externalversions/internalinterfaces"
+	v1 "github.com/alibaba/higress/client/pkg/listers/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// Http2RpcInformer provides access to a shared informer and lister for
+// Http2Rpcs.
+type Http2RpcInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1.Http2RpcLister
+}
+
+type http2RpcInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewHttp2RpcInformer constructs a new informer for Http2Rpc type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewHttp2RpcInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredHttp2RpcInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredHttp2RpcInformer constructs a new informer for Http2Rpc type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredHttp2RpcInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1().Http2Rpcs(namespace).List(context.TODO(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1().Http2Rpcs(namespace).Watch(context.TODO(), options)
+			},
+		},
+		&networkingv1.Http2Rpc{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *http2RpcInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredHttp2RpcInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *http2RpcInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&networkingv1.Http2Rpc{}, f.defaultInformer)
+}
+
+func (f *http2RpcInformer) Lister() v1.Http2RpcLister {
+	return v1.NewHttp2RpcLister(f.Informer().GetIndexer())
+}

client/pkg/informers/externalversions/networking/v1/interface.gen.go

@@ -22,6 +22,8 @@ import (
 
 // Interface provides access to all the informers in this group version.
 type Interface interface {
+	// Http2Rpcs returns a Http2RpcInformer.
+	Http2Rpcs() Http2RpcInformer
 	// McpBridges returns a McpBridgeInformer.
 	McpBridges() McpBridgeInformer
 }
@@ -37,6 +39,11 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
+// Http2Rpcs returns a Http2RpcInformer.
+func (v *version) Http2Rpcs() Http2RpcInformer {
+	return &http2RpcInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
 // McpBridges returns a McpBridgeInformer.
 func (v *version) McpBridges() McpBridgeInformer {
 	return &mcpBridgeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}

client/pkg/listers/networking/v1/expansion_generated.gen.go

@@ -16,6 +16,14 @@
 
 package v1
 
+// Http2RpcListerExpansion allows custom methods to be added to
+// Http2RpcLister.
+type Http2RpcListerExpansion interface{}
+
+// Http2RpcNamespaceListerExpansion allows custom methods to be added to
+// Http2RpcNamespaceLister.
+type Http2RpcNamespaceListerExpansion interface{}
+
 // McpBridgeListerExpansion allows custom methods to be added to
 // McpBridgeLister.
 type McpBridgeListerExpansion interface{}

client/pkg/listers/networking/v1/http2rpc.gen.go

@@ -0,0 +1,92 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// Http2RpcLister helps list Http2Rpcs.
+type Http2RpcLister interface {
+	// List lists all Http2Rpcs in the indexer.
+	List(selector labels.Selector) (ret []*v1.Http2Rpc, err error)
+	// Http2Rpcs returns an object that can list and get Http2Rpcs.
+	Http2Rpcs(namespace string) Http2RpcNamespaceLister
+	Http2RpcListerExpansion
+}
+
+// http2RpcLister implements the Http2RpcLister interface.
+type http2RpcLister struct {
+	indexer cache.Indexer
+}
+
+// NewHttp2RpcLister returns a new Http2RpcLister.
+func NewHttp2RpcLister(indexer cache.Indexer) Http2RpcLister {
+	return &http2RpcLister{indexer: indexer}
+}
+
+// List lists all Http2Rpcs in the indexer.
+func (s *http2RpcLister) List(selector labels.Selector) (ret []*v1.Http2Rpc, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1.Http2Rpc))
+	})
+	return ret, err
+}
+
+// Http2Rpcs returns an object that can list and get Http2Rpcs.
+func (s *http2RpcLister) Http2Rpcs(namespace string) Http2RpcNamespaceLister {
+	return http2RpcNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// Http2RpcNamespaceLister helps list and get Http2Rpcs.
+type Http2RpcNamespaceLister interface {
+	// List lists all Http2Rpcs in the indexer for a given namespace.
+	List(selector labels.Selector) (ret []*v1.Http2Rpc, err error)
+	// Get retrieves the Http2Rpc from the indexer for a given namespace and name.
+	Get(name string) (*v1.Http2Rpc, error)
+	Http2RpcNamespaceListerExpansion
+}
+
+// http2RpcNamespaceLister implements the Http2RpcNamespaceLister
+// interface.
+type http2RpcNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Http2Rpcs in the indexer for a given namespace.
+func (s http2RpcNamespaceLister) List(selector labels.Selector) (ret []*v1.Http2Rpc, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1.Http2Rpc))
+	})
+	return ret, err
+}
+
+// Get retrieves the Http2Rpc from the indexer for a given namespace and name.
+func (s http2RpcNamespaceLister) Get(name string) (*v1.Http2Rpc, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1.Resource("http2rpc"), name)
+	}
+	return obj.(*v1.Http2Rpc), nil
+}

helm/core/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.0.0
+appVersion: 1.1.0
 description: Helm chart for deploying higress gateways
 icon: https://higress.io/img/higress_logo_small.png
 home: http://higress.io/
@@ -10,4 +10,4 @@ name: higress-core
 sources:
 - http://github.com/alibaba/higress
 type: application
-version: 1.0.0
+version: 1.1.0

helm/core/crds/customresourcedefinitions.gen.yaml

@@ -104,6 +104,88 @@ spec:
     subresources:
       status: {}
 
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
+  name: http2rpcs.networking.higress.io
+spec:
+  group: networking.higress.io
+  names:
+    categories:
+    - higress-io
+    kind: Http2Rpc
+    listKind: Http2RpcList
+    plural: http2rpcs
+    singular: http2rpc
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          spec:
+            oneOf:
+            - not:
+                anyOf:
+                - required:
+                  - dubbo
+                - required:
+                  - grpc
+            - required:
+              - dubbo
+            - required:
+              - grpc
+            properties:
+              dubbo:
+                properties:
+                  group:
+                    type: string
+                  methods:
+                    items:
+                      properties:
+                        headersAttach:
+                          type: string
+                        httpMethods:
+                          items:
+                            type: string
+                          type: array
+                        httpPath:
+                          type: string
+                        params:
+                          items:
+                            properties:
+                              paramKey:
+                                type: string
+                              paramSource:
+                                type: string
+                              paramType:
+                                type: string
+                            type: object
+                          type: array
+                        serviceMethod:
+                          type: string
+                      type: object
+                    type: array
+                  service:
+                    type: string
+                  version:
+                    type: string
+                type: object
+              grpc:
+                type: object
+            type: object
+          status:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition

helm/core/templates/controller-clusterrole.yaml

@@ -46,6 +46,10 @@ rules:
     resources: ["wasmplugins"]
     verbs: ["get", "list", "watch"]
 
+  - apiGroups: ["networking.higress.io"]
+    resources: ["http2rpcs"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+
   - apiGroups: [""]
     resources: ["services"]
     verbs: ["get", "watch", "list", "update", "patch", "create", "delete"]

helm/core/values.yaml

@@ -45,7 +45,7 @@ global:
   # Dev builds from prow are on gcr.io
   hub: higress-registry.cn-hangzhou.cr.aliyuncs.com/higress
   # Default tag for Istio images.
-  tag: 1.0.0
+  tag: 1.1.0
 
   # Specify image pull policy if default behavior isn't desired.
   # Default behavior: latest images will be Always else IfNotPresent.
@@ -369,7 +369,7 @@ gateway:
   name: "higress-gateway"
   replicas: 2
   image: gateway
-  tag: "1.0.0"
+  tag: "1.1.0"
   # revision declares which revision this gateway is a part of
   revision: ""
 
@@ -457,7 +457,7 @@ controller:
   name: "higress-controller"
   replicas: 1
   image: higress
-  tag: "1.0.0"
+  tag: "1.1.0"
   env: {}
 
   labels: {}
@@ -547,7 +547,7 @@ pilot:
   rollingMaxUnavailable: 25%
 
   hub: higress-registry.cn-hangzhou.cr.aliyuncs.com/higress
-  tag: 1.0.0
+  tag: 1.1.0
 
   # Can be a full hub/image:tag
   image: pilot
@@ -560,7 +560,7 @@ pilot:
       memory: 2048Mi
 
   env:
-    PILOT_SCOPE_GATEWAY_TO_NAMESPACE: "true"
+    PILOT_SCOPE_GATEWAY_TO_NAMESPACE: "false"
     PILOT_ENABLE_METADATA_EXCHANGE: "false"
     PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY: "false"
     VALIDATION_ENABLED: "false"

helm/higress/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: higress-core
   repository: file://../core
-  version: 1.0.0
+  version: 1.1.0
 - name: higress-console
   repository: https://higress.io/helm-charts/
-  version: 1.0.1
-digest: sha256:cb0808ac6feff2bebf1184969defe5d0b7bf6d12d45e9bd39751df94af731dc0
-generated: "2023-06-16T10:15:54.5326712+08:00"
+  version: 1.1.0
+digest: sha256:ab013ed8a315faf016e4114f2315af3449df0a6aa62bb0b8b83704d346109722
+generated: "2023-07-10T20:56:37.100196+08:00"

helm/higress/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.0.1
+appVersion: 1.1.0
 description: Helm chart for deploying Higress gateways
 icon: https://higress.io/img/higress_logo_small.png
 home: http://higress.io/
@@ -12,9 +12,9 @@ sources:
 dependencies:
 - name: higress-core
   repository: "file://../core"
-  version: 1.0.0
+  version: 1.1.0
 - name: higress-console
   repository: "https://higress.io/helm-charts/"
-  version: 1.0.1
+  version: 1.1.0
 type: application
-version: 1.0.1
+version: 1.1.0

istio/1.12/patches/istio/20221027-init.patch

@@ -140,7 +140,7 @@ index 25479439b7..bd34442260 100755
  
  # This script builds and version stamps the output
  
-+export GOPROXY="https://proxy.golang.com.cn,direct"
++export GOPROXY=${GOPROXY:-"https://proxy.golang.com.cn,direct"}
 +
  VERBOSE=${VERBOSE:-"0"}
  V=""
@@ -215,10 +215,11 @@ index 271fe77a2d..c9e625efdc 100755
      --init \
      --sig-proxy=true \
      ${DOCKER_SOCKET_MOUNT:--v /var/run/docker.sock:/var/run/docker.sock} \
-@@ -55,7 +59,15 @@ read -ra DOCKER_RUN_OPTIONS <<< "${DOCKER_RUN_OPTIONS:-}"
+@@ -55,7 +59,16 @@ read -ra DOCKER_RUN_OPTIONS <<< "${DOCKER_RUN_OPTIONS:-}"
      --env-file <(env | grep -v ${ENV_BLOCKLIST}) \
      -e IN_BUILD_CONTAINER=1 \
      -e TZ="${TIMEZONE:-$TZ}" \
++    -e GOPROXY="${GOPROXY}" \
 +    -e HUB="${HUB}" \
 +    -e ENVOY_TAR_PATH="${ENVOY_TAR_PATH}" \
 +    --mount "type=bind,source=${MOUNT_PACKAGE_SOURCE},destination=/home/package" \

istio/1.12/patches/istio/20230618-debug-api-anonymous.patch

@@ -0,0 +1,30 @@
+diff --color -Naur istio/pilot/pkg/features/pilot.go istio_new/pilot/pkg/features/pilot.go
+--- istio/pilot/pkg/features/pilot.go	2023-06-18 20:13:57.715044832 +0800
++++ istio_new/pilot/pkg/features/pilot.go	2023-06-18 20:11:40.310406690 +0800
+@@ -359,6 +359,9 @@
+ 	EnableUnsafeAdminEndpoints = env.RegisterBoolVar("UNSAFE_ENABLE_ADMIN_ENDPOINTS", false,
+ 		"If this is set to true, dangerous admin endpoints will be exposed on the debug interface. Not recommended for production.").Get()
+ 
++	DebugAuth = env.RegisterBoolVar("DEBUG_AUTH", true,
++		"If this is set to false, the debug interface will allow all anonymous request from any remote host, which is not recommended for production").Get()
++
+ 	XDSAuth = env.RegisterBoolVar("XDS_AUTH", true,
+ 		"If true, will authenticate XDS clients.").Get()
+ 
+diff --color -Naur istio/pilot/pkg/xds/debug.go istio_new/pilot/pkg/xds/debug.go
+--- istio/pilot/pkg/xds/debug.go	2023-06-18 20:13:57.695044739 +0800
++++ istio_new/pilot/pkg/xds/debug.go	2023-06-18 20:11:40.286406579 +0800
+@@ -218,8 +218,12 @@
+ 	if internalMux != nil {
+ 		internalMux.HandleFunc(path, handler)
+ 	}
++	handlerFunc := http.HandlerFunc(handler)
++	if features.DebugAuth {
++		handlerFunc = s.allowAuthenticatedOrLocalhost(handlerFunc)
++	}
+ 	// Add handler with auth; this is expose on an HTTP server
+-	mux.HandleFunc(path, s.allowAuthenticatedOrLocalhost(http.HandlerFunc(handler)))
++	mux.HandleFunc(path, handlerFunc)
+ }
+ 
+ func (s *DiscoveryServer) allowAuthenticatedOrLocalhost(next http.Handler) http.HandlerFunc {

istio/1.12/patches/istio/20230627-debug-fix-configz.patch

@@ -0,0 +1,15 @@
+diff -Naur istio/pilot/pkg/xds/debug.go istio-new/pilot/pkg/xds/debug.go
+--- istio/pilot/pkg/xds/debug.go	2023-06-27 14:08:00.000000000 +0800
++++ istio-new/pilot/pkg/xds/debug.go	2023-06-27 14:07:04.000000000 +0800
+@@ -469,6 +469,11 @@
+ 	s.Env.IstioConfigStore.Schemas().ForEach(func(schema collection.Schema) bool {
+ 		cfg, _ := s.Env.IstioConfigStore.List(schema.Resource().GroupVersionKind(), "")
+ 		// Added by ingress
++		copied := make([]config.Config, len(cfg))
++		for i := range copied {
++			copied[i] = cfg[i].DeepCopy()
++		}
++		cfg = copied
+ 		switch schema.Resource().GroupVersionKind().String() {
+ 		case gvk.Gateway.String():
+ 			cfg = model.GatewayFilter(cfg)

pkg/ingress/config/ingress_config.go

@@ -15,6 +15,7 @@
 package config
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -25,6 +26,7 @@ import (
 	wasm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/wasm/v3"
 	httppb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/wasm/v3"
+	"github.com/gogo/protobuf/jsonpb"
 	"github.com/gogo/protobuf/types"
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"google.golang.org/protobuf/types/known/anypb"
@@ -42,10 +44,13 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	higressext "github.com/alibaba/higress/api/extensions/v1alpha1"
+	higressv1 "github.com/alibaba/higress/api/networking/v1"
 	extlisterv1 "github.com/alibaba/higress/client/pkg/listers/extensions/v1alpha1"
 	netlisterv1 "github.com/alibaba/higress/client/pkg/listers/networking/v1"
 	"github.com/alibaba/higress/pkg/ingress/kube/annotations"
 	"github.com/alibaba/higress/pkg/ingress/kube/common"
+	"github.com/alibaba/higress/pkg/ingress/kube/configmap"
+	"github.com/alibaba/higress/pkg/ingress/kube/http2rpc"
 	"github.com/alibaba/higress/pkg/ingress/kube/ingress"
 	"github.com/alibaba/higress/pkg/ingress/kube/ingressv1"
 	"github.com/alibaba/higress/pkg/ingress/kube/mcpbridge"
@@ -54,12 +59,30 @@ import (
 	"github.com/alibaba/higress/pkg/ingress/kube/wasmplugin"
 	. "github.com/alibaba/higress/pkg/ingress/log"
 	"github.com/alibaba/higress/pkg/kube"
+	"github.com/alibaba/higress/registry/memory"
 	"github.com/alibaba/higress/registry/reconcile"
 )
 
 var (
-	_ model.ConfigStoreCache = &IngressConfig{}
-	_ model.IngressStore     = &IngressConfig{}
+	_                 model.ConfigStoreCache = &IngressConfig{}
+	_                 model.IngressStore     = &IngressConfig{}
+	Http2RpcMethodMap                        = func() map[string]string {
+		return map[string]string{
+			"GET":    "ALL_GET",
+			"POST":   "ALL_POST",
+			"PUT":    "ALL_PUT",
+			"DELETE": "ALL_DELETE",
+			"PATCH":  "ALL_PATCH",
+		}
+	}
+	Http2RpcParamSourceMap = func() map[string]string {
+		return map[string]string{
+			"QUERY":  "ALL_QUERY_PARAMETER",
+			"HEADER": "ALL_HEADER",
+			"PATH":   "ALL_PATH",
+			"BODY":   "ALL_BODY",
+		}
+	}
 )
 
 type IngressConfig struct {
@@ -98,6 +121,14 @@ type IngressConfig struct {
 
 	wasmPlugins map[string]*extensions.WasmPlugin
 
+	http2rpcController http2rpc.Http2RpcController
+
+	http2rpcLister netlisterv1.Http2RpcLister
+
+	http2rpcs map[string]*higressv1.Http2Rpc
+
+	configmapMgr *configmap.ConfigmapMgr
+
 	XDSUpdater model.XDSUpdater
 
 	annotationHandler annotations.AnnotationHandler
@@ -125,6 +156,7 @@ func NewIngressConfig(localKubeClient kube.Client, XDSUpdater model.XDSUpdater,
 		namespace:           namespace,
 		mcpbridgeReconciled: true,
 		wasmPlugins:         make(map[string]*extensions.WasmPlugin),
+		http2rpcs:           make(map[string]*higressv1.Http2Rpc),
 	}
 	mcpbridgeController := mcpbridge.NewController(localKubeClient, clusterId)
 	mcpbridgeController.AddEventHandler(config.AddOrUpdateMcpBridge, config.DeleteMcpBridge)
@@ -135,6 +167,15 @@ func NewIngressConfig(localKubeClient kube.Client, XDSUpdater model.XDSUpdater,
 	wasmPluginController.AddEventHandler(config.AddOrUpdateWasmPlugin, config.DeleteWasmPlugin)
 	config.wasmPluginController = wasmPluginController
 	config.wasmPluginLister = wasmPluginController.Lister()
+
+	http2rpcController := http2rpc.NewController(localKubeClient, clusterId)
+	http2rpcController.AddEventHandler(config.AddOrUpdateHttp2Rpc, config.DeleteHttp2Rpc)
+	config.http2rpcController = http2rpcController
+	config.http2rpcLister = http2rpcController.Lister()
+
+	higressConfigController := configmap.NewController(localKubeClient, clusterId, namespace)
+	config.configmapMgr = configmap.NewConfigmapMgr(XDSUpdater, namespace, higressConfigController, higressConfigController.Lister())
+
 	return config
 }
 
@@ -207,8 +248,24 @@ func (m *IngressConfig) List(typ config.GroupVersionKind, namespace string) ([]c
 	if typ == gvk.EnvoyFilter {
 		m.mutex.RLock()
 		defer m.mutex.RUnlock()
-		IngressLog.Infof("resource type %s, configs number %d", typ, len(m.cachedEnvoyFilters))
-		return m.cachedEnvoyFilters, nil
+		var envoyFilters []config.Config
+		// Build configmap envoy filters
+		configmapEnvoyFilters, err := m.configmapMgr.ConstructEnvoyFilters()
+		if err != nil {
+			IngressLog.Errorf("Construct configmap EnvoyFilters error %v", err)
+		} else {
+			for _, envoyFilter := range configmapEnvoyFilters {
+				envoyFilters = append(envoyFilters, *envoyFilter)
+			}
+			IngressLog.Infof("Append %d configmap EnvoyFilters", len(configmapEnvoyFilters))
+		}
+		if len(envoyFilters) == 0 {
+			IngressLog.Infof("resource type %s, configs number %d", typ, len(m.cachedEnvoyFilters))
+			return m.cachedEnvoyFilters, nil
+		}
+		envoyFilters = append(envoyFilters, m.cachedEnvoyFilters...)
+		IngressLog.Infof("resource type %s, configs number %d", typ, len(envoyFilters))
+		return envoyFilters, nil
 	}
 
 	var configs []config.Config
@@ -458,6 +515,18 @@ func (m *IngressConfig) convertEnvoyFilter(convertOptions *common.ConvertOptions
 				continue
 			}
 
+			http2rpc := route.WrapperConfig.AnnotationsConfig.Http2Rpc
+			if http2rpc != nil {
+				IngressLog.Infof("Found http2rpc for name %s", http2rpc.Name)
+				envoyFilter, err := m.constructHttp2RpcEnvoyFilter(http2rpc, route, m.namespace)
+				if err != nil {
+					IngressLog.Errorf("Construct http2rpc EnvoyFilter error %v", err)
+				} else {
+					IngressLog.Infof("Append http2rpc EnvoyFilter for name %s", http2rpc.Name)
+					envoyFilters = append(envoyFilters, *envoyFilter)
+				}
+			}
+
 			auth := route.WrapperConfig.AnnotationsConfig.Auth
 			if auth == nil {
 				continue
@@ -521,6 +590,7 @@ func (m *IngressConfig) convertServiceEntry([]common.WrapperConfig) []config.Con
 		return nil
 	}
 	serviceEntries := m.RegistryReconciler.GetAllServiceEntryWrapper()
+	IngressLog.Infof("Found http2rpc serviceEntries %s", serviceEntries)
 	out := make([]config.Config, 0, len(serviceEntries))
 	for _, se := range serviceEntries {
 		out = append(out, config.Config{
@@ -912,6 +982,38 @@ func (m *IngressConfig) DeleteMcpBridge(clusterNamespacedName util.ClusterNamesp
 	}
 }
 
+func (m *IngressConfig) AddOrUpdateHttp2Rpc(clusterNamespacedName util.ClusterNamespacedName) {
+	if clusterNamespacedName.Namespace != m.namespace {
+		return
+	}
+	http2rpc, err := m.http2rpcLister.Http2Rpcs(clusterNamespacedName.Namespace).Get(clusterNamespacedName.Name)
+	if err != nil {
+		IngressLog.Errorf("http2rpc is not found, namespace:%s, name:%s",
+			clusterNamespacedName.Namespace, clusterNamespacedName.Name)
+		return
+	}
+	m.mutex.Lock()
+	m.http2rpcs[clusterNamespacedName.Name] = &http2rpc.Spec
+	m.mutex.Unlock()
+	IngressLog.Infof("AddOrUpdateHttp2Rpc http2rpc ingress name %s", clusterNamespacedName.Name)
+}
+
+func (m *IngressConfig) DeleteHttp2Rpc(clusterNamespacedName util.ClusterNamespacedName) {
+	if clusterNamespacedName.Namespace != m.namespace {
+		return
+	}
+	var hit bool
+	m.mutex.Lock()
+	if _, ok := m.http2rpcs[clusterNamespacedName.Name]; ok {
+		delete(m.http2rpcs, clusterNamespacedName.Name)
+		hit = true
+	}
+	m.mutex.Unlock()
+	if hit {
+		IngressLog.Debugf("Http2Rpc triggerd deleted %s", clusterNamespacedName.Name)
+	}
+}
+
 func (m *IngressConfig) ReflectSecretChanges(clusterNamespacedName util.ClusterNamespacedName) {
 	var hit bool
 	m.mutex.RLock()
@@ -996,6 +1098,188 @@ func (m *IngressConfig) applyCanaryIngresses(convertOptions *common.ConvertOptio
 	}
 }
 
+func (m *IngressConfig) constructHttp2RpcEnvoyFilter(http2rpcConfig *annotations.Http2RpcConfig, route *common.WrapperHTTPRoute, namespace string) (*config.Config, error) {
+	mappings := m.http2rpcs
+	IngressLog.Infof("Found http2rpc mappings %v", mappings)
+	if _, exist := mappings[http2rpcConfig.Name]; !exist {
+		IngressLog.Errorf("Http2RpcConfig name %s, not found Http2Rpc CRD", http2rpcConfig.Name)
+		return nil, errors.New("invalid http2rpcConfig has no useable http2rpc")
+	}
+	http2rpcCRD := mappings[http2rpcConfig.Name]
+
+	if http2rpcCRD.GetDubbo() == nil {
+		IngressLog.Errorf("Http2RpcConfig name %s, only support Http2Rpc CRD Dubbo Service type", http2rpcConfig.Name)
+		return nil, errors.New("invalid http2rpcConfig has no useable http2rpc")
+	}
+
+	httpRoute := route.HTTPRoute
+	httpRouteDestination := httpRoute.Route[0]
+	typeStruct, err := m.constructHttp2RpcMethods(http2rpcCRD.GetDubbo())
+	if err != nil {
+		return nil, errors.New(err.Error())
+	}
+
+	return &config.Config{
+		Meta: config.Meta{
+			GroupVersionKind: gvk.EnvoyFilter,
+			Name:             common.CreateConvertedName(constants.IstioIngressGatewayName, http2rpcConfig.Name),
+			Namespace:        namespace,
+		},
+		Spec: &networking.EnvoyFilter{
+			ConfigPatches: []*networking.EnvoyFilter_EnvoyConfigObjectPatch{
+				{
+					ApplyTo: networking.EnvoyFilter_HTTP_FILTER,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+						ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_Listener{
+							Listener: &networking.EnvoyFilter_ListenerMatch{
+								FilterChain: &networking.EnvoyFilter_ListenerMatch_FilterChainMatch{
+									Filter: &networking.EnvoyFilter_ListenerMatch_FilterMatch{
+										Name: "envoy.filters.network.http_connection_manager",
+										SubFilter: &networking.EnvoyFilter_ListenerMatch_SubFilterMatch{
+											Name: "envoy.filters.http.router",
+										},
+									},
+								},
+							},
+						},
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_INSERT_BEFORE,
+						Value: buildPatchStruct(`{
+							"name":"envoy.filters.http.http_dubbo_transcoder",
+							"typed_config":{
+								"@type":"type.googleapis.com/udpa.type.v1.TypedStruct",
+								"type_url":"type.googleapis.com/envoy.extensions.filters.http.http_dubbo_transcoder.v3.HttpDubboTranscoder"
+							}
+						}`),
+					},
+				},
+				{
+					ApplyTo: networking.EnvoyFilter_HTTP_ROUTE,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+						ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration{
+							RouteConfiguration: &networking.EnvoyFilter_RouteConfigurationMatch{
+								Vhost: &networking.EnvoyFilter_RouteConfigurationMatch_VirtualHostMatch{
+									Route: &networking.EnvoyFilter_RouteConfigurationMatch_RouteMatch{
+										Name: httpRoute.Name,
+									},
+								},
+							},
+						},
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_MERGE,
+						Value:     typeStruct,
+					},
+				},
+				{
+					ApplyTo: networking.EnvoyFilter_CLUSTER,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+						ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_Cluster{
+							Cluster: &networking.EnvoyFilter_ClusterMatch{
+								Service: httpRouteDestination.Destination.Host,
+							},
+						},
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_MERGE,
+						Value: buildPatchStruct(`{
+							"upstream_config": {
+								"name":"envoy.upstreams.http.dubbo_tcp",
+								"typed_config":{
+									"@type":"type.googleapis.com/udpa.type.v1.TypedStruct",
+									"type_url":"type.googleapis.com/envoy.extensions.upstreams.http.dubbo_tcp.v3.DubboTcpConnectionPoolProto"
+								}
+							}
+						}`),
+					},
+				},
+			},
+		},
+	}, nil
+}
+
+func (m *IngressConfig) constructHttp2RpcMethods(dubbo *higressv1.DubboService) (*types.Struct, error) {
+	httpRouterTemplate := `{
+		"route": {
+			"upgrade_configs": [
+				{
+					"connect_config": {
+						"allow_post": true
+					},
+					"upgrade_type": "CONNECT"
+				}
+			]
+		},
+		"typed_per_filter_config": {
+			"envoy.filters.http.http_dubbo_transcoder": {
+				"@type": "type.googleapis.com/udpa.type.v1.TypedStruct",
+				"type_url": "type.googleapis.com/envoy.extensions.filters.http.http_dubbo_transcoder.v3.HttpDubboTranscoder",
+				"value": {
+					"request_validation_options": {
+						"reject_unknown_method": true,
+						"reject_unknown_query_parameters": true
+					},
+					"services_mapping": %s,
+					"url_unescape_spec": "ALL_CHARACTERS_EXCEPT_RESERVED"
+				}
+			}
+		}
+	}`
+	var methods []interface{}
+	for _, serviceMethod := range dubbo.GetMethods() {
+		var method = make(map[string]interface{})
+		method["name"] = serviceMethod.GetServiceMethod()
+		var params []interface{}
+		for _, methodParam := range serviceMethod.GetParams() {
+			var param = make(map[string]interface{})
+			param["extract_key"] = methodParam.GetParamKey()
+			param["extract_key_spec"] = Http2RpcParamSourceMap()[methodParam.GetParamSource()]
+			param["mapping_type"] = methodParam.GetParamType()
+			params = append(params, param)
+		}
+		method["parameter_mapping"] = params
+		var path_matcher = make(map[string]interface{})
+		path_matcher["match_http_method_spec"] = Http2RpcMethodMap()[serviceMethod.HttpMethods[0]]
+		path_matcher["match_pattern"] = serviceMethod.GetHttpPath()
+		method["path_matcher"] = path_matcher
+		var passthrough_setting = make(map[string]interface{})
+		var headersAttach = serviceMethod.GetHeadersAttach()
+		if headersAttach == "" {
+			passthrough_setting["passthrough_all_headers"] = false
+		} else if headersAttach == "*" {
+			passthrough_setting["passthrough_all_headers"] = true
+		} else {
+			passthrough_setting["passthrough_headers"] = headersAttach
+		}
+		method["passthrough_setting"] = passthrough_setting
+		methods = append(methods, method)
+	}
+	var serviceMapping = make(map[string]interface{})
+	var dubboServiceGroup = dubbo.GetGroup()
+	if dubboServiceGroup != "" {
+		serviceMapping["group"] = dubboServiceGroup
+	}
+	serviceMapping["name"] = dubbo.GetService()
+	serviceMapping["version"] = dubbo.GetVersion()
+	serviceMapping["method_mapping"] = methods
+	strBuffer := new(bytes.Buffer)
+	serviceMappingJsonStr, _ := json.Marshal(serviceMapping)
+	fmt.Fprintf(strBuffer, httpRouterTemplate, string(serviceMappingJsonStr))
+	IngressLog.Infof("Found http2rpc buildHttp2RpcMethods %s", strBuffer.String())
+	result := buildPatchStruct(strBuffer.String())
+	return result, nil
+}
+
+func buildPatchStruct(config string) *types.Struct {
+	val := &types.Struct{}
+	_ = jsonpb.Unmarshal(strings.NewReader(config), val)
+	return val
+}
+
 func constructBasicAuthEnvoyFilter(rules *common.BasicAuthRules, namespace string) (*config.Config, error) {
 	rulesStr, err := json.Marshal(rules)
 	if err != nil {
@@ -1079,9 +1363,35 @@ func constructBasicAuthEnvoyFilter(rules *common.BasicAuthRules, namespace strin
 	}, nil
 }
 
+func QueryByName(serviceEntries []*memory.ServiceEntryWrapper, serviceName string) (*memory.ServiceEntryWrapper, error) {
+	IngressLog.Infof("Found http2rpc serviceEntries %s", serviceEntries)
+	for _, se := range serviceEntries {
+		if se.ServiceName == serviceName {
+			return se, nil
+		}
+	}
+	return nil, fmt.Errorf("can't find ServiceEntry by serviceName:%v", serviceName)
+}
+
+func QueryRpcServiceVersion(serviceEntry *memory.ServiceEntryWrapper, serviceName string) (string, error) {
+	IngressLog.Infof("Found http2rpc serviceEntry %s", serviceEntry)
+	IngressLog.Infof("Found http2rpc ServiceEntry %s", serviceEntry.ServiceEntry)
+	IngressLog.Infof("Found http2rpc WorkloadSelector %s", serviceEntry.ServiceEntry.WorkloadSelector)
+	IngressLog.Infof("Found http2rpc Labels %s", serviceEntry.ServiceEntry.WorkloadSelector.Labels)
+	labels := (*serviceEntry).ServiceEntry.WorkloadSelector.Labels
+	for key, value := range labels {
+		if key == "version" {
+			return value, nil
+		}
+	}
+	return "", fmt.Errorf("can't get RpcServiceVersion for serviceName:%v", serviceName)
+}
+
 func (m *IngressConfig) Run(stop <-chan struct{}) {
 	go m.mcpbridgeController.Run(stop)
 	go m.wasmPluginController.Run(stop)
+	go m.http2rpcController.Run(stop)
+	go m.configmapMgr.HigressConfigController.Run(stop)
 }
 
 func (m *IngressConfig) HasSynced() bool {
@@ -1098,6 +1408,12 @@ func (m *IngressConfig) HasSynced() bool {
 	if !m.wasmPluginController.HasSynced() {
 		return false
 	}
+	if !m.http2rpcController.HasSynced() {
+		return false
+	}
+	if !m.configmapMgr.HigressConfigController.HasSynced() {
+		return false
+	}
 	IngressLog.Info("Ingress config controller synced.")
 	return true
 }

pkg/ingress/kube/annotations/annotations.go

@@ -69,6 +69,8 @@ type Ingress struct {
 	Match *MatchConfig
 
 	HeaderControl *HeaderControlConfig
+
+	Http2Rpc *Http2RpcConfig
 }
 
 func (i *Ingress) NeedRegexMatch() bool {
@@ -149,6 +151,7 @@ func NewAnnotationHandlerManager() AnnotationHandler {
 			ignoreCaseMatching{},
 			match{},
 			headerControl{},
+			http2rpc{},
 		},
 		gatewayHandlers: []GatewayHandler{
 			downstreamTLS{},

pkg/ingress/kube/annotations/http2rpc.go

@@ -0,0 +1,53 @@
+// Copyright (c) 2023 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package annotations
+
+import (
+	. "github.com/alibaba/higress/pkg/ingress/log"
+)
+
+const (
+	http2rpcKey        = "http2rpc-name"
+	rpcDestinationName = "rpc-destination-name"
+)
+
+// help to conform http2rpc implements method of Parse
+var _ Parser = http2rpc{}
+
+type Http2RpcConfig struct {
+	Name string
+}
+
+type http2rpc struct{}
+
+func (a http2rpc) Parse(annotations Annotations, config *Ingress, _ *GlobalContext) error {
+	if !needHttp2RpcConfig(annotations) {
+		return nil
+	}
+	value, err := annotations.ParseStringForHigress(rpcDestinationName)
+	IngressLog.Infof("Parse http2rpc ingress name %s", value)
+	if err != nil {
+		IngressLog.Errorf("parse http2rpc error %v within ingress %s/%s", err, config.Namespace, config.Name)
+		return nil
+	}
+	config.Http2Rpc = &Http2RpcConfig{
+		Name: value,
+	}
+	return nil
+}
+
+func needHttp2RpcConfig(annotations Annotations) bool {
+	return annotations.HasHigress(rpcDestinationName)
+}

pkg/ingress/kube/annotations/http2rpc_test.go

@@ -0,0 +1,59 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package annotations
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestHttp2RpcParse(t *testing.T) {
+	parser := http2rpc{}
+
+	testCases := []struct {
+		input  Annotations
+		expect *Http2RpcConfig
+	}{
+		{
+			input:  Annotations{},
+			expect: nil,
+		},
+		{
+			input: Annotations{
+				buildHigressAnnotationKey(rpcDestinationName): "",
+			},
+			expect: nil,
+		},
+		{
+			input: Annotations{
+				buildHigressAnnotationKey(rpcDestinationName): "http-dubbo-alibaba-nacos-example-DemoService",
+			},
+			expect: &Http2RpcConfig{
+				Name: "http-dubbo-alibaba-nacos-example-DemoService",
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run("", func(t *testing.T) {
+			config := &Ingress{}
+			_ = parser.Parse(testCase.input, config, nil)
+			if diff := cmp.Diff(config.Http2Rpc, testCase.expect); diff != "" {
+				t.Fatalf("TestHttp2RpcParse() mismatch: (-want +got)\n%s", diff)
+			}
+		})
+	}
+}

pkg/ingress/kube/configmap/config.go

@@ -0,0 +1,50 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package configmap
+
+import (
+	"encoding/json"
+)
+
+type Result int32
+
+const (
+	ResultNothing Result = iota
+	ResultReplace
+	ResultDelete
+
+	HigressConfigMapName = "higress-config"
+	HigressConfigMapKey  = "higress"
+
+	ModelUpdatedReason = "higress configmap updated"
+)
+
+type ItemEventHandler = func(name string)
+
+type HigressConfig struct {
+	Tracing *Tracing `json:"tracing,omitempty"`
+}
+
+func NewDefaultHigressConfig() *HigressConfig {
+	higressConfig := &HigressConfig{
+		Tracing: NewDefaultTracing(),
+	}
+	return higressConfig
+}
+
+func GetHigressConfigString(higressConfig *HigressConfig) string {
+	bytes, _ := json.Marshal(higressConfig)
+	return string(bytes)
+}

pkg/ingress/kube/configmap/controller.go

@@ -0,0 +1,202 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package configmap
+
+import (
+	"reflect"
+	"sync/atomic"
+
+	"github.com/alibaba/higress/pkg/ingress/kube/controller"
+	"github.com/alibaba/higress/pkg/ingress/kube/util"
+	. "github.com/alibaba/higress/pkg/ingress/log"
+	"istio.io/istio/pilot/pkg/model"
+	"istio.io/istio/pkg/config"
+	"istio.io/istio/pkg/config/schema/gvk"
+	kubeclient "istio.io/istio/pkg/kube"
+	"istio.io/istio/pkg/kube/controllers"
+	"k8s.io/apimachinery/pkg/types"
+	listersv1 "k8s.io/client-go/listers/core/v1"
+	"sigs.k8s.io/yaml"
+)
+
+type HigressConfigController controller.Controller[listersv1.ConfigMapNamespaceLister]
+
+func NewController(client kubeclient.Client, clusterId string, namespace string) HigressConfigController {
+	informer := client.KubeInformer().Core().V1().ConfigMaps().Informer()
+	return controller.NewCommonController("higressConfig", client.KubeInformer().Core().V1().ConfigMaps().Lister().ConfigMaps(namespace),
+		informer, GetConfigmap, clusterId)
+}
+
+func GetConfigmap(lister listersv1.ConfigMapNamespaceLister, namespacedName types.NamespacedName) (controllers.Object, error) {
+	return lister.Get(namespacedName.Name)
+}
+
+type ItemController interface {
+	GetName() string
+	AddOrUpdateHigressConfig(name util.ClusterNamespacedName, old *HigressConfig, new *HigressConfig) error
+	ValidHigressConfig(higressConfig *HigressConfig) error
+	ConstructEnvoyFilters() ([]*config.Config, error)
+	RegisterItemEventHandler(eventHandler ItemEventHandler)
+}
+
+type ConfigmapMgr struct {
+	Namespace               string
+	HigressConfigController HigressConfigController
+	HigressConfigLister     listersv1.ConfigMapNamespaceLister
+	higressConfig           atomic.Value
+	ItemControllers         []ItemController
+	XDSUpdater              model.XDSUpdater
+}
+
+func NewConfigmapMgr(XDSUpdater model.XDSUpdater, namespace string, higressConfigController HigressConfigController, higressConfigLister listersv1.ConfigMapNamespaceLister) *ConfigmapMgr {
+
+	configmapMgr := &ConfigmapMgr{
+		XDSUpdater:              XDSUpdater,
+		Namespace:               namespace,
+		HigressConfigController: higressConfigController,
+		HigressConfigLister:     higressConfigLister,
+		higressConfig:           atomic.Value{},
+	}
+	configmapMgr.HigressConfigController.AddEventHandler(configmapMgr.AddOrUpdateHigressConfig)
+	configmapMgr.SetHigressConfig(NewDefaultHigressConfig())
+
+	tracingController := NewTracingController(namespace)
+	configmapMgr.AddItemControllers(tracingController)
+	configmapMgr.initEventHandlers()
+
+	return configmapMgr
+}
+
+func (c *ConfigmapMgr) SetHigressConfig(higressConfig *HigressConfig) {
+	c.higressConfig.Store(higressConfig)
+}
+
+func (c *ConfigmapMgr) GetHigressConfig() *HigressConfig {
+	value := c.higressConfig.Load()
+	if value != nil {
+		if higressConfig, ok := value.(*HigressConfig); ok {
+			return higressConfig
+		}
+	}
+	return nil
+}
+
+func (c *ConfigmapMgr) AddItemControllers(controllers ...ItemController) {
+	c.ItemControllers = append(c.ItemControllers, controllers...)
+}
+
+func (c *ConfigmapMgr) AddOrUpdateHigressConfig(name util.ClusterNamespacedName) {
+	if name.Namespace != c.Namespace || name.Name != HigressConfigMapName {
+		return
+	}
+
+	IngressLog.Infof("configmapMgr AddOrUpdateHigressConfig")
+	higressConfigmap, err := c.HigressConfigLister.Get(HigressConfigMapName)
+	if err != nil {
+		IngressLog.Errorf("higress-config configmap is not found, namespace:%s, name:%s",
+			name.Namespace, name.Name)
+		return
+	}
+
+	if _, ok := higressConfigmap.Data[HigressConfigMapKey]; !ok {
+		return
+	}
+
+	newHigressConfig := NewDefaultHigressConfig()
+	if err = yaml.Unmarshal([]byte(higressConfigmap.Data[HigressConfigMapKey]), newHigressConfig); err != nil {
+		IngressLog.Errorf("data:%s,  convert to higress config error, error: %+v", higressConfigmap.Data[HigressConfigMapKey], err)
+		return
+	}
+
+	for _, itemController := range c.ItemControllers {
+		if itemErr := itemController.ValidHigressConfig(newHigressConfig); itemErr != nil {
+			IngressLog.Errorf("configmap %s controller valid higress config error, error: %+v", itemController.GetName(), itemErr)
+			return
+		}
+	}
+
+	oldHigressConfig := c.GetHigressConfig()
+	IngressLog.Infof("configmapMgr oldHigressConfig: %s", GetHigressConfigString(oldHigressConfig))
+	IngressLog.Infof("configmapMgr newHigressConfig: %s", GetHigressConfigString(newHigressConfig))
+	result, _ := c.CompareHigressConfig(oldHigressConfig, newHigressConfig)
+	IngressLog.Infof("configmapMgr CompareHigressConfig reuslt is %d", result)
+
+	if result == ResultNothing {
+		return
+	}
+
+	if result == ResultDelete {
+		newHigressConfig = NewDefaultHigressConfig()
+	}
+
+	if result == ResultReplace || result == ResultDelete {
+		// Pass AddOrUpdateHigressConfig to itemControllers
+		for _, itemController := range c.ItemControllers {
+			IngressLog.Infof("configmap %s controller AddOrUpdateHigressConfig", itemController.GetName())
+			if itemErr := itemController.AddOrUpdateHigressConfig(name, oldHigressConfig, newHigressConfig); itemErr != nil {
+				IngressLog.Errorf("configmap %s controller AddOrUpdateHigressConfig error, error: %+v", itemController.GetName(), itemErr)
+			}
+		}
+		c.SetHigressConfig(newHigressConfig)
+		IngressLog.Infof("configmapMgr higress config AddOrUpdate success, reuslt is %d", result)
+		// Call updateConfig
+	}
+
+}
+
+func (c *ConfigmapMgr) ConstructEnvoyFilters() ([]*config.Config, error) {
+	configs := make([]*config.Config, 0)
+	for _, itemController := range c.ItemControllers {
+		IngressLog.Infof("controller %s ConstructEnvoyFilters", itemController.GetName())
+		if itemConfigs, err := itemController.ConstructEnvoyFilters(); err != nil {
+			IngressLog.Errorf("controller %s ConstructEnvoyFilters error, error: %+v", itemController.GetName(), err)
+		} else {
+			configs = append(configs, itemConfigs...)
+		}
+	}
+	return configs, nil
+}
+
+func (c *ConfigmapMgr) CompareHigressConfig(old *HigressConfig, new *HigressConfig) (Result, error) {
+	if old == nil || new == nil {
+		return ResultNothing, nil
+	}
+
+	if !reflect.DeepEqual(old, new) {
+		return ResultReplace, nil
+	}
+
+	return ResultNothing, nil
+}
+
+func (c *ConfigmapMgr) initEventHandlers() error {
+	itemEventHandler := func(name string) {
+		c.XDSUpdater.ConfigUpdate(&model.PushRequest{
+			Full: true,
+			ConfigsUpdated: map[model.ConfigKey]struct{}{{
+				Kind:      gvk.EnvoyFilter,
+				Name:      name,
+				Namespace: c.Namespace,
+			}: {}},
+			Reason: []model.TriggerReason{ModelUpdatedReason},
+		})
+	}
+
+	for _, itemController := range c.ItemControllers {
+		itemController.RegisterItemEventHandler(itemEventHandler)
+	}
+
+	return nil
+}

pkg/ingress/kube/configmap/tracing.go

@@ -0,0 +1,408 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package configmap
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"sync/atomic"
+
+	"github.com/alibaba/higress/pkg/ingress/kube/util"
+	. "github.com/alibaba/higress/pkg/ingress/log"
+	networking "istio.io/api/networking/v1alpha3"
+	"istio.io/istio/pkg/config"
+	"istio.io/istio/pkg/config/schema/gvk"
+)
+
+const (
+	higressTracingEnvoyFilterName = "higress-config-tracing"
+	defaultTimeout                = 500
+	defaultSampling               = 100.0
+)
+
+type Tracing struct {
+	// Flag to control trace
+	Enable bool `json:"enable,omitempty"`
+	// The percentage of requests (0.0 - 100.0) that will be randomly selected for trace generation,
+	// if not requested by the client or not forced. Default is 100.0.
+	Sampling float64 `json:"sampling,omitempty"`
+	// The timeout for the gRPC request. Default is 500ms
+	Timeout int32 `json:"timeout,omitempty"`
+	// The tracer implementation to be used by Envoy.
+	//
+	// Types that are assignable to Tracer:
+	Zipkin        *Zipkin        `json:"zipkin,omitempty"`
+	Skywalking    *Skywalking    `json:"skywalking,omitempty"`
+	OpenTelemetry *OpenTelemetry `json:"opentelemetry,omitempty"`
+}
+
+// Zipkin defines configuration for a Zipkin tracer.
+type Zipkin struct {
+	// Address of the Zipkin service (e.g. _zipkin:9411_).
+	Service string `json:"service,omitempty"`
+	Port    string `json:"port,omitempty"`
+}
+
+// Skywalking Defines configuration for a Skywalking tracer.
+type Skywalking struct {
+	// Address of the Skywalking tracer.
+	Service string `json:"service,omitempty"`
+	Port    string `json:"port,omitempty"`
+	// The access token
+	AccessToken string `json:"access_token,omitempty"`
+}
+
+// OpenTelemetry Defines configuration for a OpenTelemetry tracer.
+type OpenTelemetry struct {
+	// Address of OpenTelemetry tracer.
+	Service string `json:"service,omitempty"`
+	Port    string `json:"port,omitempty"`
+}
+
+func validServiceAndPort(service string, port string) bool {
+	if len(service) == 0 || len(port) == 0 {
+		return false
+	}
+	return true
+}
+
+func validTracing(t *Tracing) error {
+	if t == nil {
+		return nil
+	}
+	if t.Timeout <= 0 {
+		return errors.New("timeout can not be less than zero")
+	}
+
+	if t.Sampling < 0 || t.Sampling > 100 {
+		return errors.New("sampling must be in (0.0 - 100.0)")
+	}
+
+	tracerNum := 0
+	if t.Zipkin != nil {
+		if validServiceAndPort(t.Zipkin.Service, t.Zipkin.Port) {
+			tracerNum++
+		} else {
+			return errors.New("zipkin service and port can not be empty")
+		}
+	}
+
+	if t.Skywalking != nil {
+		if validServiceAndPort(t.Skywalking.Service, t.Skywalking.Port) {
+			tracerNum++
+		} else {
+			return errors.New("skywalking service and port can not be empty")
+		}
+	}
+
+	if t.OpenTelemetry != nil {
+		if validServiceAndPort(t.OpenTelemetry.Service, t.OpenTelemetry.Port) {
+			tracerNum++
+		} else {
+			return errors.New("opentelemetry service and port can not be empty")
+		}
+	}
+
+	if tracerNum != 1 {
+		return errors.New("only one of skywalking，zipkin and opentelemetry configuration can be set")
+	}
+	return nil
+}
+
+func compareTracing(old *Tracing, new *Tracing) (Result, error) {
+	if old == nil && new == nil {
+		return ResultNothing, nil
+	}
+
+	if new == nil {
+		return ResultDelete, nil
+	}
+
+	if !reflect.DeepEqual(old, new) {
+		return ResultReplace, nil
+	}
+
+	return ResultNothing, nil
+}
+
+func deepCopyTracing(tracing *Tracing) (*Tracing, error) {
+	newTracing := NewDefaultTracing()
+	bytes, err := json.Marshal(tracing)
+	if err != nil {
+		return nil, err
+	}
+	err = json.Unmarshal(bytes, newTracing)
+	return newTracing, err
+}
+
+func NewDefaultTracing() *Tracing {
+	tracing := &Tracing{
+		Enable:   false,
+		Timeout:  defaultTimeout,
+		Sampling: defaultSampling,
+	}
+	return tracing
+}
+
+type TracingController struct {
+	Namespace    string
+	tracing      atomic.Value
+	Name         string
+	eventHandler ItemEventHandler
+}
+
+func NewTracingController(namespace string) *TracingController {
+	tracingMgr := &TracingController{
+		Namespace: namespace,
+		tracing:   atomic.Value{},
+		Name:      "tracing",
+	}
+	tracingMgr.SetTracing(NewDefaultTracing())
+	return tracingMgr
+}
+
+func (t *TracingController) SetTracing(tracing *Tracing) {
+	t.tracing.Store(tracing)
+}
+
+func (t *TracingController) GetTracing() *Tracing {
+	value := t.tracing.Load()
+	if value != nil {
+		if tracing, ok := value.(*Tracing); ok {
+			return tracing
+		}
+	}
+	return nil
+}
+
+func (t *TracingController) GetName() string {
+	return t.Name
+}
+
+func (t *TracingController) AddOrUpdateHigressConfig(name util.ClusterNamespacedName, old *HigressConfig, new *HigressConfig) error {
+	if err := validTracing(new.Tracing); err != nil {
+		IngressLog.Errorf("data:%+v convert to tracing , error: %+v", new.Tracing, err)
+		return nil
+	}
+
+	result, _ := compareTracing(old.Tracing, new.Tracing)
+
+	switch result {
+	case ResultReplace:
+		if newTracing, err := deepCopyTracing(new.Tracing); err != nil {
+			IngressLog.Infof("tracing deepcopy error:%v", err)
+		} else {
+			t.SetTracing(newTracing)
+			IngressLog.Infof("AddOrUpdate Higress config tracing")
+			t.eventHandler(higressTracingEnvoyFilterName)
+			IngressLog.Infof("send event with filter name:%s", higressTracingEnvoyFilterName)
+		}
+	case ResultDelete:
+		t.SetTracing(NewDefaultTracing())
+		IngressLog.Infof("Delete Higress config tracing")
+		t.eventHandler(higressTracingEnvoyFilterName)
+		IngressLog.Infof("send event with filter name:%s", higressTracingEnvoyFilterName)
+	}
+
+	return nil
+}
+
+func (t *TracingController) ValidHigressConfig(higressConfig *HigressConfig) error {
+	if higressConfig == nil {
+		return nil
+	}
+	if higressConfig.Tracing == nil {
+		return nil
+	}
+
+	return validTracing(higressConfig.Tracing)
+}
+
+func (t *TracingController) RegisterItemEventHandler(eventHandler ItemEventHandler) {
+	t.eventHandler = eventHandler
+}
+
+func (t *TracingController) ConstructEnvoyFilters() ([]*config.Config, error) {
+	configs := make([]*config.Config, 0)
+	tracing := t.GetTracing()
+	namespace := t.Namespace
+
+	if tracing == nil {
+		return configs, nil
+	}
+
+	if tracing.Enable == false {
+		return configs, nil
+	}
+
+	tracingConfig := t.constructTracingTracer(tracing, namespace)
+	if len(tracingConfig) == 0 {
+		return configs, nil
+	}
+
+	config := &config.Config{
+		Meta: config.Meta{
+			GroupVersionKind: gvk.EnvoyFilter,
+			Name:             higressTracingEnvoyFilterName,
+			Namespace:        namespace,
+		},
+		Spec: &networking.EnvoyFilter{
+			ConfigPatches: []*networking.EnvoyFilter_EnvoyConfigObjectPatch{
+				{
+					ApplyTo: networking.EnvoyFilter_NETWORK_FILTER,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+						ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_Listener{
+							Listener: &networking.EnvoyFilter_ListenerMatch{
+								FilterChain: &networking.EnvoyFilter_ListenerMatch_FilterChainMatch{
+									Filter: &networking.EnvoyFilter_ListenerMatch_FilterMatch{
+										Name: "envoy.filters.network.http_connection_manager",
+									},
+								},
+							},
+						},
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_MERGE,
+						Value:     util.BuildPatchStruct(tracingConfig),
+					},
+				},
+				{
+					ApplyTo: networking.EnvoyFilter_HTTP_FILTER,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+						ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_Listener{
+							Listener: &networking.EnvoyFilter_ListenerMatch{
+								FilterChain: &networking.EnvoyFilter_ListenerMatch_FilterChainMatch{
+									Filter: &networking.EnvoyFilter_ListenerMatch_FilterMatch{
+										Name: "envoy.filters.network.http_connection_manager",
+										SubFilter: &networking.EnvoyFilter_ListenerMatch_SubFilterMatch{
+											Name: "envoy.filters.http.router",
+										},
+									},
+								},
+							},
+						},
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_MERGE,
+						Value: util.BuildPatchStruct(`{
+							"name":"envoy.filters.http.router",
+							"typed_config":{
+								"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+								"start_child_span": true
+							}
+						}`),
+					},
+				},
+			},
+		},
+	}
+
+	configs = append(configs, config)
+	return configs, nil
+}
+
+func (t *TracingController) constructTracingTracer(tracing *Tracing, namespace string) string {
+	tracingConfig := ""
+	timeout := float32(tracing.Timeout) / 1000
+	if tracing.Skywalking != nil {
+		skywalking := tracing.Skywalking
+		tracingConfig = fmt.Sprintf(`{
+	"name": "envoy.filters.network.http_connection_manager",
+	"typed_config": {
+		"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+		"tracing": {
+			"provider": {
+				"name": "envoy.tracers.skywalking",
+				"typed_config": {
+					"@type": "type.googleapis.com/envoy.config.trace.v3.SkyWalkingConfig",
+					"client_config": {
+						"service_name": "higress-gateway.%s",
+                        "backend_token": "%s"
+					},
+					"grpc_service": {
+						"envoy_grpc": {
+							"cluster_name": "outbound|%s||%s"
+						},
+						"timeout": "%.3fs"
+					}
+				}
+			},
+			"random_sampling": {
+				"value": %.1f
+			}
+		}
+	}
+}`, namespace, skywalking.AccessToken, skywalking.Port, skywalking.Service, timeout, tracing.Sampling)
+	}
+
+	if tracing.Zipkin != nil {
+		zipkin := tracing.Zipkin
+		tracingConfig = fmt.Sprintf(`{
+	"name": "envoy.filters.network.http_connection_manager",
+	"typed_config": {
+		"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+		"tracing": {
+			"provider": {
+				"name": "envoy.tracers.zipkin",
+				"typed_config": {
+					"@type": "type.googleapis.com/envoy.config.trace.v3.ZipkinConfig",
+                    "collector_cluster": "outbound|%s||%s",
+                    "collector_endpoint": "/api/v2/spans",
+                    "collector_hostname": "higress-gateway",
+                    "collector_endpoint_version": "HTTP_JSON",
+                    "split_spans_for_request": true
+				}
+			},
+			"random_sampling": {
+				"value": %.1f
+			}
+		}
+	}
+}`, zipkin.Port, zipkin.Service, tracing.Sampling)
+	}
+
+	if tracing.OpenTelemetry != nil {
+		opentelemetry := tracing.OpenTelemetry
+		tracingConfig = fmt.Sprintf(`{
+	"name": "envoy.filters.network.http_connection_manager",
+	"typed_config": {
+		"@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+		"tracing": {
+			"provider": {
+				"name": "envoy.tracers.opentelemetry",
+				"typed_config": {
+					"@type": "type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig",
+					"service_name": "higress-gateway.%s"
+					"grpc_service": {
+						"envoy_grpc": {
+							"cluster_name": "outbound|%s||%s"
+						},
+						"timeout": "%.3fs"
+					}
+				}
+			},
+			"random_sampling": {
+				"value": %.1f
+			}
+		}
+	}
+}`, namespace, opentelemetry.Port, opentelemetry.Service, timeout, tracing.Sampling)
+	}
+	return tracingConfig
+}

pkg/ingress/kube/http2rpc/controller.go

@@ -0,0 +1,36 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http2rpc
+
+import (
+	"istio.io/istio/pkg/kube/controllers"
+	"k8s.io/apimachinery/pkg/types"
+
+	listersv1 "github.com/alibaba/higress/client/pkg/listers/networking/v1"
+	"github.com/alibaba/higress/pkg/ingress/kube/controller"
+	kubeclient "github.com/alibaba/higress/pkg/kube"
+)
+
+type Http2RpcController controller.Controller[listersv1.Http2RpcLister]
+
+func NewController(client kubeclient.Client, clusterId string) Http2RpcController {
+	informer := client.HigressInformer().Networking().V1().Http2Rpcs().Informer()
+	return controller.NewCommonController("http2rpc", client.HigressInformer().Networking().V1().Http2Rpcs().Lister(),
+		informer, GetHttp2Rpc, clusterId)
+}
+
+func GetHttp2Rpc(lister listersv1.Http2RpcLister, namespacedName types.NamespacedName) (controllers.Object, error) {
+	return lister.Http2Rpcs(namespacedName.Namespace).Get(namespacedName.Name)
+}

pkg/ingress/kube/ingress/controller.go

@@ -293,8 +293,9 @@ func (c *controller) HasSynced() bool {
 }
 
 func (c *controller) List() []config.Config {
+	c.mutex.RLock()
 	out := make([]config.Config, 0, len(c.ingresses))
-
+	c.mutex.RUnlock()
 	for _, raw := range c.ingressInformer.GetStore().List() {
 		ing, ok := raw.(*ingress.Ingress)
 		if !ok {

pkg/ingress/kube/mcpbridge/controller.go

@@ -15,16 +15,9 @@
 package mcpbridge
 
 import (
-	"time"
-
 	"istio.io/istio/pkg/kube/controllers"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/tools/cache"
 
-	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
-	"github.com/alibaba/higress/client/pkg/clientset/versioned"
-	informersv1 "github.com/alibaba/higress/client/pkg/informers/externalversions/networking/v1"
 	listersv1 "github.com/alibaba/higress/client/pkg/listers/networking/v1"
 	"github.com/alibaba/higress/pkg/ingress/kube/controller"
 	kubeclient "github.com/alibaba/higress/pkg/kube"
@@ -33,11 +26,8 @@ import (
 type McpBridgeController controller.Controller[listersv1.McpBridgeLister]
 
 func NewController(client kubeclient.Client, clusterId string) McpBridgeController {
-	informer := client.HigressInformer().InformerFor(&v1.McpBridge{}, func(k versioned.Interface, resync time.Duration) cache.SharedIndexInformer {
-		return informersv1.NewMcpBridgeInformer(k, metav1.NamespaceAll, resync,
-			cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
-	})
-	return controller.NewCommonController("mcpbridge", listersv1.NewMcpBridgeLister(informer.GetIndexer()),
+	informer := client.HigressInformer().Networking().V1().McpBridges().Informer()
+	return controller.NewCommonController("mcpbridge", client.HigressInformer().Networking().V1().McpBridges().Lister(),
 		informer, GetMcpBridge, clusterId)
 }
 

pkg/ingress/kube/util/util.go

@@ -82,3 +82,9 @@ func MessageToGoGoStruct(msg proto.Message) (*types.Struct, error) {
 func CreateServiceFQDN(namespace, name string) string {
 	return fmt.Sprintf("%s.%s.svc.%s", name, namespace, DefaultDomainSuffix)
 }
+
+func BuildPatchStruct(config string) *types.Struct {
+	val := &types.Struct{}
+	_ = jsonpb.Unmarshal(strings.NewReader(config), val)
+	return val
+}

pkg/ingress/kube/wasmplugin/controller.go

@@ -15,16 +15,9 @@
 package wasmplugin
 
 import (
-	"time"
-
 	"istio.io/istio/pkg/kube/controllers"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/tools/cache"
 
-	v1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
-	"github.com/alibaba/higress/client/pkg/clientset/versioned"
-	informersv1 "github.com/alibaba/higress/client/pkg/informers/externalversions/extensions/v1alpha1"
 	listersv1 "github.com/alibaba/higress/client/pkg/listers/extensions/v1alpha1"
 	"github.com/alibaba/higress/pkg/ingress/kube/controller"
 	kubeclient "github.com/alibaba/higress/pkg/kube"
@@ -33,11 +26,8 @@ import (
 type WasmPluginController controller.Controller[listersv1.WasmPluginLister]
 
 func NewController(client kubeclient.Client, clusterId string) WasmPluginController {
-	informer := client.HigressInformer().InformerFor(&v1.WasmPlugin{}, func(k versioned.Interface, resync time.Duration) cache.SharedIndexInformer {
-		return informersv1.NewWasmPluginInformer(k, metav1.NamespaceAll, resync,
-			cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
-	})
-	return controller.NewCommonController("wasmplugin", listersv1.NewWasmPluginLister(informer.GetIndexer()),
+	informer := client.HigressInformer().Extensions().V1alpha1().WasmPlugins().Informer()
+	return controller.NewCommonController("wasmplugin", client.HigressInformer().Extensions().V1alpha1().WasmPlugins().Lister(),
 		informer, GetWasmPlugin, clusterId)
 }
 

plugins/wasm-go/Makefile

@@ -1,11 +1,12 @@
 PLUGIN_NAME ?= hello-world
-REGISTRY ?= higress-registry.cn-hangzhou.cr.aliyuncs.com/plugins/
+BUILDER_REGISTRY ?= higress-registry.cn-hangzhou.cr.aliyuncs.com/plugins/
+REGISTRY ?=
 GO_VERSION ?= 1.19
 TINYGO_VERSION ?= 0.25.0
 ORAS_VERSION ?= 1.0.0
 HIGRESS_VERSION ?= 1.0.0-rc
 USE_HIGRESS_TINYGO ?= true
-BUILDER ?= ${REGISTRY}wasm-go-builder:go${GO_VERSION}-tinygo${TINYGO_VERSION}-oras${ORAS_VERSION}
+BUILDER ?= ${BUILDER_REGISTRY}wasm-go-builder:go${GO_VERSION}-tinygo${TINYGO_VERSION}-oras${ORAS_VERSION}
 BUILD_TIME := $(shell date "+%Y%m%d-%H%M%S")
 COMMIT_ID := $(shell git rev-parse --short HEAD 2>/dev/null)
 IMAGE_TAG = $(if $(strip $(PLUGIN_VERSION)),${PLUGIN_VERSION},${BUILD_TIME}-${COMMIT_ID})

plugins/wasm-go/README.md

@@ -143,3 +143,55 @@ spec:
 ```
 
 所有规则会按上面配置的顺序一次执行匹配，当有一个规则匹配时，就停止匹配，并选择匹配的配置执行插件逻辑。
+
+## E2E测试
+
+当你完成一个GO语言的插件功能时, 可以同时创建关联的e2e test cases, 并在本地对插件功能完成测试验证。
+
+### step1. 编写 test cases
+在目录./test/ingress/conformance下面, 分别添加xxx.yaml文件和xxx.go文件, 比如测试插件request-block
+
+./test/ingress/conformance/request-block.yaml
+```
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+...
+...
+spec:
+  defaultConfig:
+    block_urls:
+    - "swagger.html"
+  url: file:///opt/plugins/wasm-go/extensions/request-block/plugin.wasm
+```
+`其中url中extensions后面的'request-block'为插件所在文件夹名称`
+
+./test/ingress/conformance/request-block.go
+
+### step2. 添加 test cases
+将上述所写test cases添加到e2e测试列表中,
+
+./test/ingress/conformance/request-block.yaml
+
+```
+...
+cSuite.Setup(t)
+	var higressTests []suite.ConformanceTest
+
+	if *isWasmPluginTest {
+		higressTests = []suite.ConformanceTest{
+			tests.WasmPluginsRequestBlock,
+      //这里新增你新写的case方法名称
+		}
+	} else {
+		higressTests = []suite.ConformanceTest{
+			tests.HTTPRouteSimpleSameNamespace,
+			tests.HTTPRouteHostNameSameNamespace,
+...
+```
+
+### step3. 编译插件并执行 test cases
+考虑到本地构建wasm比较耗时, 我们支持只构建需要测试的插件(同时你也可以临时修改上面第二小步的测试cases列表, 只执行你新写的case)。
+
+```bash
+PLUGIN_NAME=request-block make ingress-wasmplugin-test
+```

plugins/wasm-go/README_EN.md

@@ -29,11 +29,11 @@ You can also use `make build-push` to build and push the image at the same time.
 
 ### Environmental parameters
 
-| Name          | Optional/Required | Default                                                                                                      | 含义                                                                                                                                  |
-|---------------|-------------------|--------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
-| `PLUGIN_NAME` | Optional          | hello-world                                                                                                  | The name of the plugin to build.                                                                                                    |
-| `REGISTRY`    | Optional          | empty                                                                                                        | The regitstry address of the generated image, e.g. `example.registry.io/my-name/`.  Note that the REGISTRY value should end with /. |
-| `IMG`         | Optional          | If it is empty, it is generated based on the repository address, plugin name, build time, and git commit id. | The generated image tag will override the `REGISTRY` parameter if it is not empty.                                                  |
+| Name          | Optional/Required | Default                                                                                                      | meaning                                                                                                                              |
+|---------------|---------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|
+| `PLUGIN_NAME` | Optional      | hello-world                                                                                                  | The name of the plugin to build.                                                                                                     |
+| `REGISTRY`    | Optional      | empty                                                                                                        | The registry address of the generated image, e.g. `example.registry.io/my-name/`.  Note that the REGISTRY value should end with /.   |
+| `IMG`         | Optional      | If it is empty, it is generated based on the repository address, plugin name, build time, and git commit id. | The generated image tag will override the `REGISTRY` parameter if it is not empty.                                                   |
 
 ## Build on local yourself
 
@@ -138,3 +138,55 @@ spec:
 
 The rules will be matched in the order of configuration. If one match is found, it will stop, and the matching configuration will take effect.
 
+
+## E2E test
+
+When you complete a GO plug-in function, you can create associated e2e test cases at the same time, and complete the test verification of the plug-in function locally.
+
+### step1. write test cases
+In the directory of `./ test/ingress/conformance`, add the xxx.yaml file and xxx.go file. Such as test for `request-block` wasm-plugin,
+
+./test/ingress/conformance/request-block.yaml
+```
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+...
+...
+spec:
+  defaultConfig:
+    block_urls:
+    - "swagger.html"
+  url: file:///opt/plugins/wasm-go/extensions/request-block/plugin.wasm
+```
+`Above of the url, the name of after extensions indicates the name of the folder where the plug-in resides.`
+
+./test/ingress/conformance/request-block.go
+
+### step2. add test cases
+Add the test cases written above to the e2e test list,
+
+./test/ingress/conformance/request-block.yaml
+
+```
+...
+cSuite.Setup(t)
+	var higressTests []suite.ConformanceTest
+
+	if *isWasmPluginTest {
+		higressTests = []suite.ConformanceTest{
+			tests.WasmPluginsRequestBlock,
+      //Add your newly written case method name here
+		}
+	} else {
+		higressTests = []suite.ConformanceTest{
+			tests.HTTPRouteSimpleSameNamespace,
+			tests.HTTPRouteHostNameSameNamespace,
+...
+```
+
+### step3. compile and run test cases
+Considering that building wasm locally is time-consuming, we support building only the plug-ins that need to be tested (at the same time, you can also temporarily modify the list of test cases in the second small step above, and only execute your newly written cases).
+
+```bash
+PLUGIN_NAME=request-block make ingress-wasmplugin-test
+```

plugins/wasm-go/extensions/chatgpt-proxy/README.md

@@ -0,0 +1,21 @@
+# 功能说明
+`chatgpt-proxy`插件实现了代理请求AI大语言模型服务的功能。
+
+# 配置字段
+
+| 名称 | 数据类型 | 填写要求 |  默认值 | 描述 |
+| -------- | -------- | -------- | -------- | -------- |
+|  model     |  string     | 选填   |   text-davinci-003  |  配置使用的模型模型名称   |
+|  apiKey   |  string     | 必填   |   -  |  配置使用的OpenAI API密钥   |
+|  promptParam     |  string     | 选填  |   prompt  |  配置prompt的来源字段名称，URL参数   |
+|  chatgptUri     |  string     | 选填     |  api.openai.com/v1/completions   |  配置调用AI模型服务的URL路径，默认值为OPENAI的API调用路径   |
+# 配置示例
+
+## 进行OpenAI curie模型的调用
+```yaml
+apiKey: "xxxxxxxxxxxxxx",
+promptParam: "text",
+model: "curie"
+```
+
+

plugins/wasm-go/extensions/chatgpt-proxy/go.mod

@@ -0,0 +1,15 @@
+module chatgpt-proxy
+
+go 1.19
+
+require (
+	github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230629030002-81e467b6242d
+	github.com/tetratelabs/proxy-wasm-go-sdk v0.22.0
+	github.com/tidwall/gjson v1.14.4
+)
+
+require (
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.0 // indirect
+)

plugins/wasm-go/extensions/chatgpt-proxy/go.sum

@@ -0,0 +1,22 @@
+github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230619024848-7d2a05ef1c35 h1:9xBMl8mJ5CGE1ebqtx9s11zrKJHs0559Yf/QWFh0WIQ=
+github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230619024848-7d2a05ef1c35/go.mod h1:AzSnkuon5c26nIePTiJQIAFsKdhkNdncLcTuahpGtQs=
+github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230629030002-81e467b6242d h1:PyBnIfssGRMKvBf6wKH11Z1t+X1Z7qegD1pAO60sFrk=
+github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230629030002-81e467b6242d/go.mod h1:AzSnkuon5c26nIePTiJQIAFsKdhkNdncLcTuahpGtQs=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/tetratelabs/proxy-wasm-go-sdk v0.19.1-0.20220822060051-f9d179a57f8c h1:OCUFXVGixHLfNjg6/QYEhv+jHJ5mRGhpEUVFv9eWPJE=
+github.com/tetratelabs/proxy-wasm-go-sdk v0.19.1-0.20220822060051-f9d179a57f8c/go.mod h1:5t/pWFNJ9eMyu/K/Z+OeGhDJ9sN9eCo8fc2pyM/Qjg4=
+github.com/tetratelabs/proxy-wasm-go-sdk v0.22.0 h1:kS7BvMKN+FiptV4pfwiNX8e3q14evxAWkhYbxt8EI1M=
+github.com/tetratelabs/proxy-wasm-go-sdk v0.22.0/go.mod h1:qkW5MBz2jch2u8bS59wws65WC+Gtx3x0aPUX5JL7CXI=
+github.com/tidwall/gjson v1.14.3 h1:9jvXn7olKEHU1S9vwoMGliaT8jq1vJ7IH/n9zD9Dnlw=
+github.com/tidwall/gjson v1.14.3/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

plugins/wasm-go/extensions/chatgpt-proxy/main.go

@@ -0,0 +1,128 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/alibaba/higress/plugins/wasm-go/pkg/wrapper"
+	"github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm"
+	"github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm/types"
+	"github.com/tidwall/gjson"
+)
+
+func main() {
+	wrapper.SetCtx(
+		"chatgpt-proxy",
+		wrapper.ParseConfigBy(parseConfig),
+		wrapper.ProcessRequestHeadersBy(onHttpRequestHeaders),
+	)
+}
+
+type MyConfig struct {
+	Model       string
+	ApiKey      string
+	PromptParam string
+	ChatgptPath string
+	HumainId    string
+	AIId        string
+	client      wrapper.HttpClient
+}
+
+func parseConfig(json gjson.Result, config *MyConfig, log wrapper.Log) error {
+	chatgptUri := json.Get("chatgptUri").String()
+	var chatgptHost string
+	if chatgptUri == "" {
+		config.ChatgptPath = "/v1/completions"
+		chatgptHost = "api.openai.com"
+	} else {
+		cp, err := url.Parse(chatgptUri)
+		if err != nil {
+			return err
+		}
+		config.ChatgptPath = cp.Path
+		chatgptHost = cp.Host
+	}
+	if config.ChatgptPath == "" {
+		return errors.New("not found path in chatgptUri")
+	}
+	if chatgptHost == "" {
+		return errors.New("not found host in chatgptUri")
+	}
+	config.client = wrapper.NewClusterClient(wrapper.RouteCluster{
+		Host: chatgptHost,
+	})
+	config.Model = json.Get("model").String()
+	if config.Model == "" {
+		config.Model = "text-davinci-003"
+	}
+	config.ApiKey = json.Get("apiKey").String()
+	if config.ApiKey == "" {
+		return errors.New("no apiKey found in config")
+	}
+	config.PromptParam = json.Get("promptParam").String()
+	if config.PromptParam == "" {
+		config.PromptParam = "prompt"
+	}
+	config.HumainId = json.Get("HumainId").String()
+	if config.HumainId == "" {
+		config.HumainId = "Humain:"
+	}
+	config.AIId = json.Get("AIId").String()
+	if config.AIId == "" {
+		config.AIId = "AI:"
+	}
+	return nil
+}
+
+const bodyTemplate string = `
+{
+"model":"%s",
+"prompt":"%s",
+"temperature":0.9,
+"max_tokens": 150,
+"top_p": 1,
+"frequency_penalty": 0.0,
+"presence_penalty": 0.6,
+"stop": [" %s", " %s"]
+}
+`
+
+func onHttpRequestHeaders(ctx wrapper.HttpContext, config MyConfig, log wrapper.Log) types.Action {
+	pairs := strings.SplitN(ctx.Path(), "?", 2)
+	
+	if len(pairs) < 2 {
+		proxywasm.SendHttpResponse(400, nil, []byte("1-need prompt param"), -1)
+		return types.ActionContinue
+	}
+	querys, err := url.ParseQuery(pairs[1])
+	if err != nil {
+		proxywasm.SendHttpResponse(400, nil, []byte("2-need prompt param"), -1)
+		return types.ActionContinue
+	}
+	var prompt []string
+	var ok bool
+	if prompt, ok = querys[config.PromptParam]; !ok || len(prompt) == 0 {
+		proxywasm.SendHttpResponse(400, nil, []byte("3-need prompt param"), -1)
+		return types.ActionContinue
+	}
+	body := fmt.Sprintf(bodyTemplate, config.Model, prompt[0], config.HumainId, config.AIId)
+	err = config.client.Post(config.ChatgptPath, [][2]string{
+		{"Content-Type", "application/json"},
+		{"Authorization", "Bearer " + config.ApiKey},
+	}, []byte(body),
+		func(statusCode int, responseHeaders http.Header, responseBody []byte) {
+			var headers [][2]string
+			for key, value := range responseHeaders {
+				headers = append(headers, [2]string{key, value[0]})
+			}
+			proxywasm.SendHttpResponse(uint32(statusCode), headers, responseBody, -1)
+		}, 10000)
+	if err != nil {
+		proxywasm.SendHttpResponse(500, nil, []byte("Internel Error: "+err.Error()), -1)
+		return types.ActionContinue
+	}
+	return types.ActionPause
+}

plugins/wasm-go/extensions/waf/Dockerfile

@@ -0,0 +1,3 @@
+FROM scratch
+
+COPY local/main.wasm /plugin.wasm

plugins/wasm-go/extensions/waf/README.md

@@ -0,0 +1,52 @@
+# 功能说明
+waf插件实现了基于ModSecurity的规则防护引擎，可以根据用户配置的规则屏蔽可疑请求，并支持OWASP CRS，为站点提供基础的防护功能。
+
+# 配置字段
+| 名称 | 数据类型 | 填写要求 |  默认值 | 描述 |
+| -------- | -------- | -------- | -------- | -------- |
+| useCRS | bool | 选填 | false | 是否开启OWASP CRS，详情可参考[coreruleset](https://github.com/coreruleset/coreruleset/tree/v3.3.2) |
+| secRules | array of string | 选填 | - | 用户自定义的waf防护规则，语法规则可参考[ModSecurity中文手册](http://www.modsecurity.cn/chm/) |
+
+# 配置示例
+```yaml
+useCRS: true
+secRules: 
+  - "SecDebugLogLevel 3"
+  - "SecRuleEngine On"
+  - "SecAction \"id:100,phase:1,pass\""
+  - "SecRule REQUEST_URI \"@streq /admin\" \"id:101,phase:1,t:lowercase,deny\""
+  - "SecRule REQUEST_BODY \"@rx maliciouspayload\" \"id:102,phase:2,t:lowercase,deny\""
+```
+
+根据该配置，以下请求将被禁止访问：
+```bash
+curl http://example.com/admin
+curl http://example.com -d "maliciouspayload"
+```
+
+# 对特定路由或域名开启
+```yaml
+useCRS: true
+secRules: 
+  - "SecDebugLogLevel 3"
+  - "SecRuleEngine On"
+  - "SecAction \"id:100,phase:1,pass\""
+  - "SecRule REQUEST_URI \"@streq /admin\" \"id:101,phase:1,t:lowercase,deny\""
+  - "SecRule REQUEST_BODY \"@rx maliciouspayload\" \"id:102,phase:2,t:lowercase,deny\""
+_rules_:
+- _match_route_:
+    - "route-1"
+  secRules:
+    - "SecDebugLogLevel 3"
+    - "SecRuleEngine On"
+    - "SecAction \"id:102,phase:1,deny\""
+- _match_domain_:
+    - "*.example.com"
+    - test.com
+  secRules:
+    - "SecDebugLogLevel 3"
+    - "SecRuleEngine On"
+    - "SecAction \"id:102,phase:1,pass\""
+```
+
+此例 `_match_route_` 中指定的 `route-1` 即在创建网关路由时填写的路由名称，当匹配到这两个路由时，将使用此段配置； 此例 `_match_domain_` 中指定的 `*.example.com` 和 `test.com` 用于匹配请求的域名，当发现域名匹配时，将使用此段配置； 配置的匹配生效顺序，将按照 `_rules_` 下规则的排列顺序，匹配第一个规则后生效对应配置，后续规则将被忽略。

plugins/wasm-go/extensions/waf/go.mod

@@ -0,0 +1,37 @@
+module github.com/corazawaf/coraza-proxy-wasm
+
+go 1.19
+
+require (
+	github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230504075705-7e358eb1db7c
+	github.com/corazawaf/coraza-wasilibs v0.0.0-20230408002644-e2e3af21f503
+	github.com/corazawaf/coraza/v3 v3.0.0-rc.1.0.20230407165813-a18681b1ec28
+	github.com/stretchr/testify v1.8.0
+	github.com/tetratelabs/proxy-wasm-go-sdk v0.22.0
+	github.com/tidwall/gjson v1.14.4
+	github.com/wasilibs/nottinygc v0.2.0
+)
+
+require (
+	github.com/corazawaf/libinjection-go v0.1.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/kr/pretty v0.1.0 // indirect
+	github.com/magefile/mage v1.14.0 // indirect
+	github.com/petar-dambovaliev/aho-corasick v0.0.0-20211021192214-5ab2d9280aa9 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/tetratelabs/wazero v1.0.1 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/wasilibs/go-aho-corasick v0.3.0 // indirect
+	github.com/wasilibs/go-libinjection v0.2.1 // indirect
+	github.com/wasilibs/go-re2 v1.0.0 // indirect
+	golang.org/x/net v0.9.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	rsc.io/binaryregexp v0.2.0 // indirect
+)
+
+replace (
+	github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230504075705-7e358eb1db7c => github.com/rinfx/higress/plugins/wasm-go v0.0.0-20230508112120-f2d89b0606ee
+)

plugins/wasm-go/extensions/waf/go.sum

@@ -0,0 +1,65 @@
+github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230504075705-7e358eb1db7c h1:RKZJGYAkczZVqvJ/CuNJSY6YI5oyJjzm12MVzf3Z7/U=
+github.com/alibaba/higress/plugins/wasm-go v0.0.0-20230504075705-7e358eb1db7c/go.mod h1:AzSnkuon5c26nIePTiJQIAFsKdhkNdncLcTuahpGtQs=
+github.com/corazawaf/coraza-wasilibs v0.0.0-20230408002644-e2e3af21f503 h1:hGXspDwUBHQUne1NT2D6PmkR9wFCXsibjaJpz7xhf+g=
+github.com/corazawaf/coraza-wasilibs v0.0.0-20230408002644-e2e3af21f503/go.mod h1:bTc+NV7T2wQevFQHDDWhD/+IAA5bvKbbK4CxzfvJx/o=
+github.com/corazawaf/coraza/v3 v3.0.0-rc.1.0.20230407165813-a18681b1ec28 h1:Jrlvhe4YCR/PMCazDEBeun/XTYhlzczBN0WN4/ejORo=
+github.com/corazawaf/coraza/v3 v3.0.0-rc.1.0.20230407165813-a18681b1ec28/go.mod h1:TKREBLh55w3SiBbLsQpH9EFzjBAmEUH4KRaZ/kFYz20=
+github.com/corazawaf/libinjection-go v0.1.2 h1:oeiV9pc5rvJ+2oqOqXEAMJousPpGiup6f7Y3nZj5GoM=
+github.com/corazawaf/libinjection-go v0.1.2/go.mod h1:OP4TM7xdJ2skyXqNX1AN1wN5nNZEmJNuWbNPOItn7aw=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo=
+github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
+github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20211021192214-5ab2d9280aa9 h1:lL+y4Xv20pVlCGyLzNHRC0I0rIHhIL1lTvHizoS/dU8=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20211021192214-5ab2d9280aa9/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rinfx/higress/plugins/wasm-go v0.0.0-20230508112120-f2d89b0606ee h1:5qHbEcei04hDcUTzvoFNtYtZiewnTgVv6wR9co8Ih6c=
+github.com/rinfx/higress/plugins/wasm-go v0.0.0-20230508112120-f2d89b0606ee/go.mod h1:AzSnkuon5c26nIePTiJQIAFsKdhkNdncLcTuahpGtQs=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/tetratelabs/proxy-wasm-go-sdk v0.22.0 h1:kS7BvMKN+FiptV4pfwiNX8e3q14evxAWkhYbxt8EI1M=
+github.com/tetratelabs/proxy-wasm-go-sdk v0.22.0/go.mod h1:qkW5MBz2jch2u8bS59wws65WC+Gtx3x0aPUX5JL7CXI=
+github.com/tetratelabs/wazero v1.0.1 h1:xyWBoGyMjYekG3mEQ/W7xm9E05S89kJ/at696d/9yuc=
+github.com/tetratelabs/wazero v1.0.1/go.mod h1:wYx2gNRg8/WihJfSDxA1TIL8H+GkfLYm+bIfbblu9VQ=
+github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
+github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/wasilibs/go-aho-corasick v0.3.0 h1:ScfPQhAwop/ELIkwY0dfMTFb/bwOdYI/MB3mkX2WOZI=
+github.com/wasilibs/go-aho-corasick v0.3.0/go.mod h1:LKW6EW9NWuWYE8PII+sFpRbbY3UcrMUgfUTkGaoWyMY=
+github.com/wasilibs/go-libinjection v0.2.1 h1:1aSwyE4oNpPGpFw3i3hoM15sF3qn1s4P0jC2jgFM2Qk=
+github.com/wasilibs/go-libinjection v0.2.1/go.mod h1:ZUoVe+HLQYq+QPBNTSgg3fxGvZsvXiDbi0UomBlsGzo=
+github.com/wasilibs/go-re2 v1.0.0 h1:pvrqtMzZgTMHVPfXJrk4YZwiqIXOKdfo5aed6CzUAW4=
+github.com/wasilibs/go-re2 v1.0.0/go.mod h1:8g69JapfgjSCx49dKOQij1dqA3sOvoH5NteaUy1X0SA=
+github.com/wasilibs/nottinygc v0.2.0 h1:cXz2Ac9bVMLkpuOlUlPQMWowjw0K2cOErXZOFdAj7yE=
+github.com/wasilibs/nottinygc v0.2.0/go.mod h1:oDcIotskuYNMpqMF23l7Z8uzD4TC0WXHK8jetlB3HIo=
+golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
+golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=

plugins/wasm-go/extensions/waf/init_tinygo.go

@@ -0,0 +1,14 @@
+//go:build tinygo
+
+package main
+
+import _ "github.com/wasilibs/nottinygc"
+
+// Compiled by nottinygc for delayed free but Envoy doesn't stub it yet,
+// luckily nottinygc doesn't actually call the function, so it's fine to
+// stub it out.
+
+//export sched_yield
+func sched_yield() int32 {
+	return 0
+}

plugins/wasm-go/extensions/waf/local/Dockerfile

@@ -0,0 +1,3 @@
+FROM liuxr25/flask-helloworld:latest
+
+COPY app.py /work/app.py

plugins/wasm-go/extensions/waf/local/app.py

@@ -0,0 +1,14 @@
+from flask import Flask, request
+
+app = Flask(__name__)
+
+@app.route("/flask/test1", methods=["GET", "POST"])
+def test1():
+    return "body normal", 200, [("test-header", "hahaha")]
+
+@app.route("/flask/test2", methods=["GET", "POST"])
+def test2():
+    return "body attack", 200, []
+
+if __name__ == "__main__":
+    app.run("0.0.0.0", 5000)

plugins/wasm-go/extensions/waf/local/docker-compose.yaml

@@ -0,0 +1,96 @@
+services:
+  httpbin:
+    image: kennethreitz/httpbin
+    environment:
+      - MAX_BODY_SIZE=15728640 # 15 MiB
+    ports:
+      - 8083:8080
+    command:
+      - "gunicorn"
+      - "-b"
+      - "0.0.0.0:8080"
+      - "httpbin:app"
+      - "-k"
+      - "gevent"
+      - --log-file
+      - /home/envoy/logs/httpbin.log
+    volumes:
+      - logs:/home/envoy/logs:rw
+
+  flask:
+    # image: liuxr25/flask-helloworld:latest
+    build: .
+    environment:
+      - MAX_BODY_SIZE=15728640 # 15 MiB
+    ports:
+      - 8084:5000
+
+  chown:
+    image: alpine:3.16
+    command:
+      - /bin/sh
+      - -c
+      - chown -R 101:101 /home/envoy/logs
+    volumes:
+      - logs:/home/envoy/logs:rw
+
+  envoy:
+    depends_on:
+      - chown
+      - httpbin
+      - flask
+    image: higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/envoy:1.20
+    command:
+      - -c
+      - /conf/envoy-config.yaml
+      - --log-level
+      - info
+      - --component-log-level
+      - wasm:debug
+      - --log-format [%Y-%m-%d %T.%f][%t][%l][%n] [%g:%#] %v
+      - --log-path
+      - /home/envoy/logs/envoy.log
+    volumes:
+      - .:/build
+      - .:/conf
+      - logs:/home/envoy/logs:rw
+    ports:
+      - 8080:8080
+      - 8082:8082
+
+  # envoy-logs:
+  #   depends_on:
+  #     - envoy
+  #     - wasm-logs
+  #   image: debian:11-slim
+  #   entrypoint: bash
+  #   command:
+  #     - -c
+  #     - tail -c +0 -f /home/envoy/logs/envoy.log
+  #   volumes:
+  #     - logs:/home/envoy/logs:ro
+
+  wasm-logs:
+    depends_on:
+      - envoy
+    image: debian:11-slim
+    entrypoint: bash
+    command:
+      - -c
+      - tail -c +0 -f /home/envoy/logs/envoy.log | grep --line-buffered "[critical][wasm]"
+    volumes:
+      - logs:/home/envoy/logs:ro
+
+  # debug-logs:
+  #   depends_on:
+  #     - envoy
+  #   image: debian:11-slim
+  #   entrypoint: bash
+  #   command:
+  #     - -c
+  #     - tail -c +0 -f /home/envoy/logs/envoy.log | grep --line-buffered "unreachable"
+  #   volumes:
+  #     - logs:/home/envoy/logs:ro
+
+volumes:
+  logs:

plugins/wasm-go/extensions/waf/local/envoy-config.yaml

@@ -0,0 +1,143 @@
+stats_config:
+  stats_tags:
+    # Envoy extracts the first matching group as a value.
+    # See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/metrics/v3/stats.proto#config-metrics-v3-statsconfig.
+    - tag_name: phase
+      regex: "(_phase=([a-z_]+))"
+    - tag_name: rule_id
+      regex: "(_ruleid=([0-9]+))"
+
+static_resources:
+  listeners:
+    - address:
+        socket_address:
+          address: 0.0.0.0
+          port_value: 8080
+      filter_chains:
+        - filters:
+            - name: envoy.filters.network.http_connection_manager
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                stat_prefix: ingress_http
+                codec_type: auto
+                route_config:
+                  virtual_hosts:
+                    - name: local_route
+                      domains:
+                        - "*"
+                      routes:
+                        - name: "route_1"
+                          match:
+                            path: "/headers"
+                          route:
+                            cluster: httpbin_server
+                        - name: "route_2"
+                          match:
+                            path: "/user-agent"
+                          route:
+                            cluster: httpbin_server
+                        - name: "route_flask"
+                          match:
+                            prefix: "/flask"
+                          route:
+                            cluster: flask_server
+                        - name: "route_httpbin"
+                          match:
+                            prefix: "/"
+                          route:
+                            cluster: httpbin_server
+                        # - name: "route_mock"
+                        #   match:
+                        #     prefix: "/"
+                        #   direct_response:
+                        #     status: 200
+                        #     body:
+                        #       inline_string: "mock response\n"
+                http_filters:
+                  - name: envoy.filters.http.wasm
+                    typed_config:
+                      "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
+                      config:
+                        name: "coraza-filter"
+                        root_id: ""
+                        configuration:
+                          "@type": "type.googleapis.com/google.protobuf.StringValue"
+                          value: |
+                            {
+                              "useCRS": true,
+                              "secRules": [
+                                "SecDebugLogLevel 3",
+                                "SecRuleEngine On",
+                                "SecRule REQUEST_URI \"@streq /admin\" \"id:101,phase:1,t:lowercase,deny\"",
+                                "SecRule REQUEST_BODY \"@rx maliciouspayload\" \"id:102,phase:2,t:lowercase,deny\"",
+                                "SecRule RESPONSE_HEADERS::status \"@rx 406\" \"id:103,phase:3,t:lowercase,deny\"",
+                                "SecRule RESPONSE_HEADERS:test-header \"@streq hahaha\" \"id:104,phase:3,t:lowercase,deny\"",
+                                "SecRule RESPONSE_BODY \"@rx attack\" \"id:105,phase:4,t:lowercase,deny\""
+                              ],
+                              "_rules_": [
+                                {
+                                  "_match_route_": [
+                                    "route_1"
+                                  ],
+                                  "secRules": [
+                                    "SecDebugLogLevel 3",
+                                    "SecRuleEngine On",
+                                    "SecAction \"id:102,phase:1,deny\""
+                                  ]
+                                },
+                                {
+                                  "_match_route_": [
+                                    "route_2"
+                                  ],
+                                  "secRules": [
+                                    "SecDebugLogLevel 3",
+                                    "SecRuleEngine On",
+                                    "SecAction \"id:102,phase:1,pass\""
+                                  ]
+                                }
+                              ]
+                            }
+                        vm_config:
+                          runtime: "envoy.wasm.runtime.v8"
+                          vm_id: "10086"
+                          code:
+                            local:
+                              filename: "build/main.wasm"
+                  - name: envoy.filters.http.router
+                    typed_config:
+                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+
+  clusters:
+    - name: httpbin_server
+      connect_timeout: 6000s
+      type: STRICT_DNS
+      lb_policy: ROUND_ROBIN
+      load_assignment:
+        cluster_name: httpbin_server
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: httpbin
+                      port_value: 8080
+    - name: flask_server
+      connect_timeout: 6000s
+      type: STRICT_DNS
+      lb_policy: ROUND_ROBIN
+      load_assignment:
+        cluster_name: flask_server
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: flask
+                      port_value: 5000
+
+admin:
+  access_log_path: "/dev/null"
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 8082

plugins/wasm-go/extensions/waf/mage.go

@@ -0,0 +1,16 @@
+//go:build ignore
+// +build ignore
+
+// Entrypoint to mage for running without needing to install the command.
+// https://magefile.org/zeroinstall/
+package main
+
+import (
+	"os"
+
+	"github.com/magefile/mage/mage"
+)
+
+func main() {
+	os.Exit(mage.Main())
+}

plugins/wasm-go/extensions/waf/magefiles/go.mod

@@ -0,0 +1,16 @@
+module github.com/corazawaf/coraza-proxy-wasm/magefiles
+
+go 1.19
+
+require (
+	fortio.org/fortio v1.38.4
+	github.com/magefile/mage v1.14.0
+	github.com/tetratelabs/wabin v0.0.0-20220927005300-3b0fbf39a46a
+)
+
+require (
+	github.com/google/uuid v1.3.0 // indirect
+	golang.org/x/exp v0.0.0-20221111204811-129d8d6c17ab // indirect
+	golang.org/x/net v0.2.0 // indirect
+	golang.org/x/text v0.4.0 // indirect
+)

plugins/wasm-go/extensions/waf/magefiles/go.sum

@@ -0,0 +1,21 @@
+fortio.org/assert v1.1.2 h1:t6WGDqPD5VFrUvx30U0+3mgXXcoPonrdKqt0vfJHn8E=
+fortio.org/fortio v1.38.4 h1:HkVsu9E4emMU+i2D2HjPll1Dbu5IqCRTeKeoiYWxFWA=
+fortio.org/fortio v1.38.4/go.mod h1:xZTReCI6wlPJQN+JssVO6jsqXJV2vC32dcZJrUaqmcU=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo=
+github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/tetratelabs/wabin v0.0.0-20220927005300-3b0fbf39a46a h1:P0R3+CTAT7daT8ig5gh9GEd/eDQ5md1xl4pkYMcwOqg=
+github.com/tetratelabs/wabin v0.0.0-20220927005300-3b0fbf39a46a/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk=
+golang.org/x/exp v0.0.0-20221111204811-129d8d6c17ab h1:1S7USr8/C0Sgk4egxq4zZ07zYt2Xh1IiFp8hUMXH/us=
+golang.org/x/exp v0.0.0-20221111204811-129d8d6c17ab/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/net v0.2.0 h1:sZfSu1wtKLGlWI4ZZayP0ck9Y73K1ynO6gqzTdBVdPU=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
+golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

plugins/wasm-go/extensions/waf/magefiles/loadtest.go

@@ -0,0 +1,81 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"fortio.org/fortio/fhttp"
+	"fortio.org/fortio/fnet"
+	"fortio.org/fortio/periodic"
+	"github.com/magefile/mage/sh"
+)
+
+// LoadTest runs load tests against the ftw deployment.
+func LoadTest() error {
+	for _, threads := range []int{1, 2, 4} {
+		for _, payloadSize := range []int{0, 100, 1000, 10000} {
+			for _, conf := range []string{"envoy-config.yaml", "envoy-config-nowasm.yaml"} {
+				if err := doLoadTest(conf, payloadSize, threads); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func doLoadTest(conf string, payloadSize int, threads int) error {
+	if err := sh.RunV("docker-compose", "--file", "ftw/docker-compose.yml", "build", "--pull"); err != nil {
+		return err
+	}
+	defer func() {
+		_ = sh.RunV("docker-compose", "--file", "ftw/docker-compose.yml", "kill")
+		_ = sh.RunV("docker-compose", "--file", "ftw/docker-compose.yml", "down", "-v")
+	}()
+	if err := sh.RunWithV(map[string]string{"ENVOY_CONFIG": fmt.Sprintf("/conf/%s", conf)}, "docker-compose",
+		"--file", "ftw/docker-compose.yml", "run", "--service-ports", "--rm", "-d", "envoy"); err != nil {
+		return err
+	}
+
+	// Wait for Envoy to start.
+	for i := 0; i < 1000; i++ {
+		if resp, err := http.Get("http://localhost:8080/anything"); err != nil {
+			continue
+		} else {
+			if resp.Body != nil {
+				resp.Body.Close()
+			}
+			if resp.StatusCode == http.StatusOK {
+				break
+			}
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+
+	opts := &fhttp.HTTPRunnerOptions{
+		RunnerOptions: periodic.RunnerOptions{
+			QPS:        100,
+			NumThreads: threads,
+			Duration:   10 * time.Second,
+		},
+		HTTPOptions: fhttp.HTTPOptions{
+			URL:     "http://localhost:8080/anything",
+			Payload: fnet.GenerateRandomPayload(payloadSize),
+		},
+	}
+
+	fmt.Printf("Running load test with config=%s, payloadSize=%d, threads=%d\n", conf, payloadSize, threads)
+	res, err := fhttp.RunHTTPTest(opts)
+	if err != nil {
+		return err
+	}
+	rr := res.Result()
+	fmt.Printf("All done %d calls (plus %d warmup) %.3f ms avg, %.1f qps\n",
+		rr.DurationHistogram.Count,
+		0,
+		1000.*rr.DurationHistogram.Avg,
+		rr.ActualQPS)
+
+	return nil
+}

plugins/wasm-go/extensions/waf/magefiles/magefile.go

@@ -0,0 +1,271 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/magefile/mage/mg"
+	"github.com/magefile/mage/sh"
+	"github.com/tetratelabs/wabin/binary"
+	"github.com/tetratelabs/wabin/wasm"
+)
+
+var minGoVersion = "1.19"
+var tinygoMinorVersion = "0.27"
+var addLicenseVersion = "04bfe4ee9ca5764577b029acc6a1957fd1997153" // https://github.com/google/addlicense
+var golangCILintVer = "v1.48.0"                                    // https://github.com/golangci/golangci-lint/releases
+var gosImportsVer = "v0.3.1"                                       // https://github.com/rinchsan/gosimports/releases/tag/v0.3.1
+
+var errCommitFormatting = errors.New("files not formatted, please commit formatting changes")
+var errNoGitDir = errors.New("no .git directory found")
+
+func init() {
+	for _, check := range []func() error{
+		checkTinygoVersion,
+		checkGoVersion,
+	} {
+		if err := check(); err != nil {
+			fmt.Printf("Error: %v\n", err)
+			os.Exit(1)
+		}
+	}
+}
+
+// checkGoVersion checks the minimum version of Go is supported.
+func checkGoVersion() error {
+	v, err := sh.Output("go", "version")
+	if err != nil {
+		return fmt.Errorf("unexpected go error: %v", err)
+	}
+
+	// Version can/cannot include patch version e.g.
+	// - go version go1.19 darwin/arm64
+	// - go version go1.19.2 darwin/amd64
+	versionRegex := regexp.MustCompile("go([0-9]+).([0-9]+).?([0-9]+)?")
+	compare := versionRegex.FindStringSubmatch(v)
+	if len(compare) != 4 {
+		return fmt.Errorf("unexpected go semver: %q", v)
+	}
+	compare = compare[1:]
+	if compare[2] == "" {
+		compare[2] = "0"
+	}
+
+	base := strings.SplitN(minGoVersion, ".", 3)
+	if len(base) == 2 {
+		base = append(base, "0")
+	}
+	for i := 0; i < 3; i++ {
+		baseN, _ := strconv.Atoi(base[i])
+		compareN, _ := strconv.Atoi(compare[i])
+		if baseN > compareN {
+			return fmt.Errorf("unexpected go version, minimum want %q, have %q", minGoVersion, strings.Join(compare, "."))
+		}
+	}
+	return nil
+}
+
+// checkTinygoVersion checks that exactly the right tinygo version is supported because
+// tinygo isn't stable yet.
+func checkTinygoVersion() error {
+	v, err := sh.Output("tinygo", "version")
+	if err != nil {
+		return fmt.Errorf("unexpected tinygo error: %v", err)
+	}
+
+	// Assume a dev build is valid.
+	if strings.Contains(v, "-dev") {
+		return nil
+	}
+
+	if !strings.HasPrefix(v, fmt.Sprintf("tinygo version %s", tinygoMinorVersion)) {
+		return fmt.Errorf("unexpected tinygo version, wanted %s", tinygoMinorVersion)
+	}
+
+	return nil
+}
+
+// Format formats code in this repository.
+func Format() error {
+	if err := sh.RunV("go", "mod", "tidy"); err != nil {
+		return err
+	}
+	// addlicense strangely logs skipped files to stderr despite not being erroneous, so use the long sh.Exec form to
+	// discard stderr too.
+	if _, err := sh.Exec(map[string]string{}, io.Discard, io.Discard, "go", "run", fmt.Sprintf("github.com/google/addlicense@%s", addLicenseVersion),
+		"-c", "The OWASP Coraza contributors",
+		"-s=only",
+		"-y=",
+		"-ignore", "**/*.yml",
+		"-ignore", "**/*.yaml",
+		"-ignore", "examples/**", "."); err != nil {
+		return err
+	}
+	return sh.RunV("go", "run", fmt.Sprintf("github.com/rinchsan/gosimports/cmd/gosimports@%s", gosImportsVer),
+		"-w",
+		"-local",
+		"github.com/corazawaf/coraza-proxy-wasm",
+		".")
+}
+
+// Lint verifies code quality.
+func Lint() error {
+	if err := sh.RunV("go", "run", fmt.Sprintf("github.com/golangci/golangci-lint/cmd/golangci-lint@%s", golangCILintVer), "run"); err != nil {
+		return err
+	}
+
+	mg.SerialDeps(Format)
+
+	if sh.Run("git", "diff", "--exit-code") != nil {
+		return errCommitFormatting
+	}
+
+	return nil
+}
+
+// Test runs all unit tests.
+func Test() error {
+	return sh.RunV("go", "test", "./...")
+}
+
+// Coverage runs tests with coverage and race detector enabled.
+func Coverage() error {
+	if err := os.MkdirAll("build", 0755); err != nil {
+		return err
+	}
+	if err := sh.RunV("go", "test", "-race", "-coverprofile=build/coverage.txt", "-covermode=atomic", "-coverpkg=./...", "./..."); err != nil {
+		return err
+	}
+
+	return sh.RunV("go", "tool", "cover", "-html=build/coverage.txt", "-o", "build/coverage.html")
+}
+
+// Doc runs godoc, access at http://localhost:6060
+func Doc() error {
+	return sh.RunV("go", "run", "golang.org/x/tools/cmd/godoc@latest", "-http=:6060")
+}
+
+// Check runs lint and tests.
+func Check() {
+	mg.SerialDeps(Lint, Test)
+}
+
+// Build builds the Coraza wasm plugin.
+func Build() error {
+	if err := os.MkdirAll("local", 0755); err != nil {
+		return err
+	}
+
+	buildTags := []string{"custommalloc", "no_fs_access"}
+	if os.Getenv("TIMING") == "true" {
+		buildTags = append(buildTags, "timing", "proxywasm_timing")
+	}
+	if os.Getenv("MEMSTATS") == "true" {
+		buildTags = append(buildTags, "memstats")
+	}
+
+	buildTagArg := fmt.Sprintf("-tags='%s'", strings.Join(buildTags, " "))
+
+	// ~100MB initial heap
+	initialPages := 2100
+	if ipEnv := os.Getenv("INITIAL_PAGES"); ipEnv != "" {
+		if ip, err := strconv.Atoi(ipEnv); err != nil {
+			return err
+		} else {
+			initialPages = ip
+		}
+	}
+
+	if err := sh.RunV("tinygo", "build", "-gc=custom", "-opt=2", "-o", filepath.Join("local", "mainraw.wasm"), "-scheduler=none", "-target=wasi", buildTagArg); err != nil {
+		return err
+	}
+
+	if err := patchWasm(filepath.Join("local", "mainraw.wasm"), filepath.Join("local", "main.wasm"), initialPages); err != nil {
+		return err
+	}
+
+	if err := sh.RunV("rm", filepath.Join("local", "mainraw.wasm")); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// E2e runs e2e tests with a built plugin against the example deployment. Requires docker-compose.
+func E2e() error {
+	if err := sh.RunV("docker-compose", "--file", "e2e/docker-compose.yml", "build", "--pull"); err != nil {
+		return err
+	}
+	return sh.RunV("docker-compose", "-f", "e2e/docker-compose.yml", "up", "--abort-on-container-exit", "tests")
+}
+
+// Ftw runs ftw tests with a built plugin and Envoy. Requires docker-compose.
+func Ftw() error {
+	if err := sh.RunV("docker-compose", "--file", "ftw/docker-compose.yml", "build", "--pull"); err != nil {
+		return err
+	}
+	defer func() {
+		_ = sh.RunV("docker-compose", "--file", "ftw/docker-compose.yml", "down", "-v")
+	}()
+	env := map[string]string{
+		"FTW_CLOUDMODE": os.Getenv("FTW_CLOUDMODE"),
+		"FTW_INCLUDE":   os.Getenv("FTW_INCLUDE"),
+		"ENVOY_IMAGE":   os.Getenv("ENVOY_IMAGE"),
+	}
+	if os.Getenv("ENVOY_NOWASM") == "true" {
+		env["ENVOY_CONFIG"] = "/conf/envoy-config-nowasm.yaml"
+	}
+	task := "ftw"
+	if os.Getenv("MEMSTATS") == "true" {
+		task = "ftw-memstats"
+	}
+	return sh.RunWithV(env, "docker-compose", "--file", "ftw/docker-compose.yml", "run", "--rm", task)
+}
+
+// RunExample spins up the test environment, access at http://localhost:8080. Requires docker-compose.
+func RunExample() error {
+	return sh.RunWithV(map[string]string{"ENVOY_IMAGE": os.Getenv("ENVOY_IMAGE")}, "docker-compose", "--file", "example/docker-compose.yml", "up", "-d", "envoy-logs")
+}
+
+// TeardownExample tears down the test environment. Requires docker-compose.
+func TeardownExample() error {
+	return sh.RunV("docker-compose", "--file", "example/docker-compose.yml", "down")
+}
+
+var Default = Build
+
+func patchWasm(inPath, outPath string, initialPages int) error {
+	raw, err := os.ReadFile(inPath)
+	if err != nil {
+		return err
+	}
+	mod, err := binary.DecodeModule(raw, wasm.CoreFeaturesV2)
+	if err != nil {
+		return err
+	}
+
+	mod.MemorySection.Min = uint32(initialPages)
+
+	for _, imp := range mod.ImportSection {
+		switch {
+		case imp.Name == "fd_filestat_get":
+			imp.Name = "fd_fdstat_get"
+		case imp.Name == "path_filestat_get":
+			imp.Module = "env"
+			imp.Name = "proxy_get_header_map_value"
+		}
+	}
+
+	out := binary.EncodeModule(mod)
+	if err = os.WriteFile(outPath, out, 0644); err != nil {
+		return err
+	}
+
+	return nil
+}

plugins/wasm-go/extensions/waf/main.go

@@ -0,0 +1,14 @@
+package main
+
+import (
+	"github.com/corazawaf/coraza-proxy-wasm/wasmplugin"
+	wasilibs "github.com/corazawaf/coraza-wasilibs"
+)
+
+func main() {
+	wasilibs.RegisterRX()
+	wasilibs.RegisterPM()
+	wasilibs.RegisterSQLi()
+	wasilibs.RegisterXSS()
+	wasmplugin.PluginStart()
+}

plugins/wasm-go/extensions/waf/wasmplugin/fs.go

@@ -0,0 +1,79 @@
+package wasmplugin
+
+import (
+	"embed"
+	"fmt"
+	"io/fs"
+	"strings"
+)
+
+var (
+	//go:embed rules
+	crs  embed.FS
+	root fs.FS
+)
+
+func init() {
+	rules, _ := fs.Sub(crs, "rules")
+	root = &rulesFS{
+		rules,
+		map[string]string{
+			"@recommended-conf":    "coraza.conf-recommended.conf",
+			"@demo-conf":           "coraza-demo.conf",
+			"@crs-setup-demo-conf": "crs-setup-demo.conf",
+			"@ftw-conf":            "ftw-config.conf",
+			"@crs-setup-conf":      "crs-setup.conf.example",
+		},
+		map[string]string{
+			"@owasp_crs": "crs",
+		},
+	}
+}
+
+type rulesFS struct {
+	fs           fs.FS
+	filesMapping map[string]string
+	dirsMapping  map[string]string
+}
+
+func (r rulesFS) Open(name string) (fs.File, error) {
+	return r.fs.Open(r.mapPath(name))
+}
+
+func (r rulesFS) ReadDir(name string) ([]fs.DirEntry, error) {
+	for a, dst := range r.dirsMapping {
+		if a == name {
+			return fs.ReadDir(r.fs, dst)
+		}
+
+		prefix := a + "/"
+		if strings.HasPrefix(name, prefix) {
+			return fs.ReadDir(r.fs, fmt.Sprintf("%s/%s", dst, name[len(prefix):]))
+		}
+	}
+	return fs.ReadDir(r.fs, name)
+}
+
+func (r rulesFS) ReadFile(name string) ([]byte, error) {
+	return fs.ReadFile(r.fs, r.mapPath(name))
+}
+
+func (r rulesFS) mapPath(p string) string {
+	if strings.IndexByte(p, '/') != -1 {
+		// is not in root, hence we can do dir mapping
+		for a, dst := range r.dirsMapping {
+			prefix := a + "/"
+			if strings.HasPrefix(p, prefix) {
+				return fmt.Sprintf("%s/%s", dst, p[len(prefix):])
+			}
+		}
+	}
+
+	for a, dst := range r.filesMapping {
+		if a == p {
+			return dst
+		}
+	}
+
+	return p
+}

plugins/wasm-go/extensions/waf/wasmplugin/plugin.go

@@ -0,0 +1,339 @@
+package wasmplugin
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+
+	"github.com/alibaba/higress/plugins/wasm-go/pkg/wrapper"
+	"github.com/corazawaf/coraza/v3"
+	ctypes "github.com/corazawaf/coraza/v3/types"
+	"github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm"
+	"github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm/types"
+	"github.com/tidwall/gjson"
+)
+
+func PluginStart() {
+	wrapper.SetCtx(
+		"waf-plugin-go",
+		wrapper.ParseConfigBy(parseConfig),
+		wrapper.ProcessRequestHeadersBy(onHttpRequestHeaders),
+		wrapper.ProcessRequestBodyBy(onHttpRequestBody),
+		wrapper.ProcessResponseBodyBy(onHttpResponseBody),
+		wrapper.ProcessResponseHeadersBy(onHttpResponseHeaders),
+		wrapper.ProcessStreamDoneBy(onHttpStreamDone),
+	)
+}
+
+type WafConfig struct {
+	waf coraza.WAF
+	//tx  ctypes.Transaction
+}
+
+func parseConfig(json gjson.Result, config *WafConfig, log wrapper.Log) error {
+	var secRules []string
+	var value gjson.Result
+	value = json.Get("useCRS")
+	if value.Exists() {
+		if value.Bool() {
+			secRules = append(secRules, "Include @demo-conf")
+			secRules = append(secRules, "Include @crs-setup-demo-conf")
+			secRules = append(secRules, "Include @owasp_crs/*.conf")
+			secRules = append(secRules, "SecRuleEngine On")
+		}
+	}
+	value = json.Get("secRules")
+	if value.Exists() {
+		for _, item := range json.Get("secRules").Array() {
+			rule := item.String()
+			secRules = append(secRules, rule)
+		}
+	}
+
+	// log.Debugf("[rinfx log] %s", strings.Join(secRules, "\n"))
+	conf := coraza.NewWAFConfig().WithRootFS(root)
+	// error: Failed to load Wasm module due to a missing import: wasi_snapshot_preview1.fd_filestat_get
+	// because without fs.go
+	waf, err := coraza.NewWAF(conf.WithDirectives(strings.Join(secRules, "\n")))
+
+	config.waf = waf
+	if err != nil {
+		log.Errorf("Failed to create waf conf: %v", err)
+		return errors.New("failed to create waf conf")
+	}
+
+	return nil
+}
+
+func onHttpRequestHeaders(ctx wrapper.HttpContext, config WafConfig, log wrapper.Log) types.Action {
+	ctx.SetContext("interruptionHandled", false)
+	ctx.SetContext("processedRequestBody", false)
+	ctx.SetContext("processedResponseBody", false)
+	ctx.SetContext("tx", config.waf.NewTransaction())
+
+	tx := ctx.GetContext("tx").(ctypes.Transaction)
+
+	// Note the pseudo-header :path includes the query.
+	// See https://httpwg.org/specs/rfc9113.html#rfc.section.8.3.1
+	uri, err := proxywasm.GetHttpRequestHeader(":path")
+	if err != nil {
+		log.Error("Failed to get :path")
+		return types.ActionContinue
+	}
+
+	// This currently relies on Envoy's behavior of mapping all requests to HTTP/2 semantics
+	// and its request properties, but they may not be true of other proxies implementing
+	// proxy-wasm.
+
+	if tx.IsRuleEngineOff() {
+		// log.Infof("[rinfx log] OnHttpRequestHeaders, RuleEngine Off, url = %s", uri)
+		return types.ActionContinue
+	}
+	// OnHttpRequestHeaders does not terminate if IP/Port retrieve goes wrong
+	srcIP, srcPort := retrieveAddressInfo(log, "source")
+	dstIP, dstPort := retrieveAddressInfo(log, "destination")
+
+	tx.ProcessConnection(srcIP, srcPort, dstIP, dstPort)
+
+	// proxywasm.LogInfof("[rinfx log] OnHttpRequestHeaders, RuleEngine On, url = %s", uri)
+
+	method, err := proxywasm.GetHttpRequestHeader(":method")
+	if err != nil {
+		log.Error("Failed to get :method")
+		return types.ActionContinue
+	}
+
+	protocol, err := proxywasm.GetProperty([]string{"request", "protocol"})
+	if err != nil {
+		// TODO(anuraaga): HTTP protocol is commonly required in WAF rules, we should probably
+		// fail fast here, but proxytest does not support properties yet.
+		protocol = []byte("HTTP/2.0")
+	}
+
+	ctx.SetContext("httpProtocol", string(protocol))
+
+	tx.ProcessURI(uri, method, string(protocol))
+
+	hs, err := proxywasm.GetHttpRequestHeaders()
+	if err != nil {
+		log.Error("Failed to get request headers")
+		return types.ActionContinue
+	}
+
+	for _, h := range hs {
+		tx.AddRequestHeader(h[0], h[1])
+	}
+
+	// CRS rules tend to expect Host even with HTTP/2
+	authority, err := proxywasm.GetHttpRequestHeader(":authority")
+	if err == nil {
+		tx.AddRequestHeader("Host", authority)
+		tx.SetServerName(parseServerName(log, authority))
+	}
+
+	interruption := tx.ProcessRequestHeaders()
+	if interruption != nil {
+		return handleInterruption(ctx, "http_request_headers", interruption, log)
+	}
+
+	return types.ActionContinue
+}
+
+func onHttpRequestBody(ctx wrapper.HttpContext, config WafConfig, body []byte, log wrapper.Log) types.Action {
+	// log.Info("[rinfx log] OnHttpRequestBody")
+
+	if ctx.GetContext("interruptionHandled").(bool) {
+		log.Error("OnHttpRequestBody, interruption already handled")
+		return types.ActionContinue
+	}
+
+	tx := ctx.GetContext("tx").(ctypes.Transaction)
+
+	if tx.IsRuleEngineOff() {
+		return types.ActionContinue
+	}
+
+	// Do not perform any action related to request body data if SecRequestBodyAccess is set to false
+	if !tx.IsRequestBodyAccessible() {
+		log.Info("Skipping request body inspection, SecRequestBodyAccess is off.")
+		// ProcessRequestBody is still performed for phase 2 rules, checking already populated variables
+		ctx.SetContext("processedRequestBody", true)
+		interruption, err := tx.ProcessRequestBody()
+		if err != nil {
+			log.Error("Failed to process request body")
+			return types.ActionContinue
+		}
+
+		if interruption != nil {
+			return handleInterruption(ctx, "http_request_body", interruption, log)
+		}
+
+		return types.ActionContinue
+	}
+
+	interruption, _, err := tx.WriteRequestBody(body)
+	if err != nil {
+		log.Error("Failed to write request body")
+		return types.ActionContinue
+	}
+
+	if interruption != nil {
+		return handleInterruption(ctx, "http_request_body", interruption, log)
+	}
+
+	ctx.SetContext("processedRequestBody", true)
+	interruption, err = tx.ProcessRequestBody()
+	if err != nil {
+		log.Error("Failed to process request body")
+		return types.ActionContinue
+	}
+	if interruption != nil {
+		return handleInterruption(ctx, "http_request_body", interruption, log)
+	}
+
+	return types.ActionContinue
+}
+
+func onHttpResponseHeaders(ctx wrapper.HttpContext, config WafConfig, log wrapper.Log) types.Action {
+	// log.Info("[rinfx log] OnHttpResponseHeaders")
+
+	if ctx.GetContext("interruptionHandled").(bool) {
+		log.Error("OnHttpResponseHeaders, interruption already handled")
+		return types.ActionContinue
+	}
+
+	tx := ctx.GetContext("tx").(ctypes.Transaction)
+
+	if tx.IsRuleEngineOff() {
+		return types.ActionContinue
+	}
+
+	// Requests without body won't call OnHttpRequestBody, but there are rules in the request body
+	// phase that still need to be executed. If they haven't been executed yet, now is the time.
+	if !ctx.GetContext("processedRequestBody").(bool) {
+		ctx.SetContext("processedRequestBody", true)
+		interruption, err := tx.ProcessRequestBody()
+		if err != nil {
+			log.Error("Failed to process request body")
+			return types.ActionContinue
+		}
+		if interruption != nil {
+			return handleInterruption(ctx, "http_response_headers", interruption, log)
+		}
+	}
+
+	status, err := proxywasm.GetHttpResponseHeader(":status")
+	if err != nil {
+		log.Error("Failed to get :status")
+		return types.ActionContinue
+	}
+	code, err := strconv.Atoi(status)
+	if err != nil {
+		code = 0
+	}
+
+	hs, err := proxywasm.GetHttpResponseHeaders()
+	if err != nil {
+		log.Error("Failed to get response headers")
+		return types.ActionContinue
+	}
+
+	for _, h := range hs {
+		tx.AddResponseHeader(h[0], h[1])
+		// log.Infof("[rinfx debug] ResponseHeaders %s: %s", h[0], h[1])
+	}
+
+	interruption := tx.ProcessResponseHeaders(code, ctx.GetContext("httpProtocol").(string))
+	if interruption != nil {
+		return handleInterruption(ctx, "http_response_headers", interruption, log)
+	}
+
+	return types.ActionContinue
+}
+
+func onHttpResponseBody(ctx wrapper.HttpContext, config WafConfig, body []byte, log wrapper.Log) types.Action {
+	// log.Info("[rinfx log] OnHttpResponseBody")
+
+	if ctx.GetContext("interruptionHandled").(bool) {
+		// At response body phase, proxy-wasm currently relies on emptying the response body as a way of
+		// interruption the response. See https://github.com/corazawaf/coraza-proxy-wasm/issues/26.
+		// If OnHttpResponseBody is called again and an interruption has already been raised, it means that
+		// we have to keep going with the sanitization of the response, emptying it.
+		// Sending the crafted HttpResponse with empty body, we don't expect to trigger OnHttpResponseBody
+		log.Warn("Response body interruption already handled, keeping replacing the body")
+		// Interruption happened, we don't want to send response body data
+		return replaceResponseBodyWhenInterrupted(log, replaceResponseBody)
+	}
+
+	tx := ctx.GetContext("tx").(ctypes.Transaction)
+
+	if tx.IsRuleEngineOff() {
+		return types.ActionContinue
+	}
+
+	// Do not perform any action related to response body data if SecResponseBodyAccess is set to false
+	if !tx.IsResponseBodyAccessible() {
+		log.Debug("Skipping response body inspection, SecResponseBodyAccess is off.")
+		// ProcessResponseBody is performed for phase 4 rules, checking already populated variables
+		ctx.SetContext("processedResponseBody", true)
+		interruption, err := tx.ProcessResponseBody()
+		if err != nil {
+			log.Error("Failed to process response body")
+			return types.ActionContinue
+		}
+
+		if interruption != nil {
+			// Proxy-wasm can not anymore deny the response. The best interruption is emptying the body
+			// Coraza Multiphase evaluation will help here avoiding late interruptions
+			return handleInterruption(ctx, "http_response_body", interruption, log)
+		}
+		return types.ActionContinue
+	}
+
+	interruption, _, err := tx.WriteResponseBody(body)
+	// log.Infof("[rinfx debug] ResponseBody %s", string(body))
+	if err != nil {
+		log.Error("Failed to write response body")
+		return types.ActionContinue
+	}
+	if interruption != nil {
+		return handleInterruption(ctx, "http_response_body", interruption, log)
+	}
+
+	// We have already sent response headers, an unauthorized response can not be sent anymore,
+	// but we can still drop the response to prevent leaking sensitive content.
+	// The error will also be logged by Coraza.
+	ctx.SetContext("processedResponseBody", true)
+	interruption, err = tx.ProcessResponseBody()
+	if err != nil {
+		log.Error("Failed to process response body")
+		return types.ActionContinue
+	}
+	if interruption != nil {
+		return handleInterruption(ctx, "http_response_body", interruption, log)
+	}
+	return types.ActionContinue
+}
+
+func onHttpStreamDone(ctx wrapper.HttpContext, config WafConfig, log wrapper.Log) {
+	// log.Info("[rinfx log] OnHttpStreamDone")
+
+	tx := ctx.GetContext("tx").(ctypes.Transaction)
+
+	if !tx.IsRuleEngineOff() {
+		// Responses without body won't call OnHttpResponseBody, but there are rules in the response body
+		// phase that still need to be executed. If they haven't been executed yet, now is the time.
+		if !ctx.GetContext("processedResponseBody").(bool) {
+			ctx.SetContext("processedResponseBody", true)
+			_, err := tx.ProcessResponseBody()
+			if err != nil {
+				log.Error("Failed to process response body")
+			}
+		}
+	}
+
+	tx.ProcessLogging()
+
+	_ = tx.Close()
+	log.Info("Finished")
+}

plugins/wasm-go/extensions/waf/wasmplugin/rules/coraza-demo.conf

@@ -0,0 +1,253 @@
+# -- Rule engine initialization ----------------------------------------------
+
+# Enable Coraza, attaching it to every transaction. Use detection
+# only to start with, because that minimises the chances of post-installation
+# disruption.
+#
+SecRuleEngine On
+
+
+# -- Request body handling ---------------------------------------------------
+
+# Allow Coraza to access request bodies. If you don't, Coraza
+# won't be able to see any POST parameters, which opens a large security
+# hole for attackers to exploit.
+#
+SecRequestBodyAccess On
+
+# Enable XML request body parser.
+# Initiate XML Processor in case of xml content-type
+#
+SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+|/)|text/)xml" \
+     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
+
+# Enable JSON request body parser.
+# Initiate JSON Processor in case of JSON content-type; change accordingly
+# if your application does not use 'application/json'
+#
+SecRule REQUEST_HEADERS:Content-Type "^application/json" \
+     "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
+
+# Sample rule to enable JSON request body parser for more subtypes.
+# Uncomment or adapt this rule if you want to engage the JSON
+# Processor for "+json" subtypes
+#
+#SecRule REQUEST_HEADERS:Content-Type "^application/[a-z0-9.-]+[+]json" \
+#     "id:'200006',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
+
+# Maximum request body size we will accept for buffering. If you support
+# file uploads then the value given on the first line has to be as large
+# as the largest file you are willing to accept. The second value refers
+# to the size of data, with files excluded. You want to keep that value as
+# low as practical.
+#
+SecRequestBodyLimit 13107200
+
+SecRequestBodyInMemoryLimit 131072
+
+SecRequestBodyNoFilesLimit 131072
+
+# What to do if the request body size is above our configured limit.
+# Keep in mind that this setting will automatically be set to ProcessPartial
+# when SecRuleEngine is set to DetectionOnly mode in order to minimize
+# disruptions when initially deploying Coraza.
+#
+SecRequestBodyLimitAction Reject
+
+# Verify that we've correctly processed the request body.
+# As a rule of thumb, when failing to process a request body
+# you should reject the request (when deployed in blocking mode)
+# or log a high-severity alert (when deployed in detection-only mode).
+#
+SecRule REQBODY_ERROR "!@eq 0" \
+"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
+
+# By default be strict with what we accept in the multipart/form-data
+# request body. If the rule below proves to be too strict for your
+# environment consider changing it to detection-only. You are encouraged
+# _not_ to remove it altogether.
+#
+SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
+"id:'200003',phase:2,t:none,log,deny,status:400, \
+msg:'Multipart request body failed strict validation: \
+PE %{REQBODY_PROCESSOR_ERROR}, \
+BQ %{MULTIPART_BOUNDARY_QUOTED}, \
+BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
+DB %{MULTIPART_DATA_BEFORE}, \
+DA %{MULTIPART_DATA_AFTER}, \
+HF %{MULTIPART_HEADER_FOLDING}, \
+LF %{MULTIPART_LF_LINE}, \
+SM %{MULTIPART_MISSING_SEMICOLON}, \
+IQ %{MULTIPART_INVALID_QUOTING}, \
+IP %{MULTIPART_INVALID_PART}, \
+IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
+FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
+
+# Did we see anything that might be a boundary?
+#
+# Here is a short description about the Coraza Multipart parser: the
+# parser returns with value 0, if all "boundary-like" line matches with
+# the boundary string which given in MIME header. In any other cases it returns
+# with different value, eg. 1 or 2.
+#
+# The RFC 1341 descript the multipart content-type and its syntax must contains
+# only three mandatory lines (above the content):
+# * Content-Type: multipart/mixed; boundary=BOUNDARY_STRING
+# * --BOUNDARY_STRING
+# * --BOUNDARY_STRING--
+#
+# First line indicates, that this is a multipart content, second shows that
+# here starts a part of the multipart content, third shows the end of content.
+#
+# If there are any other lines, which starts with "--", then it should be
+# another boundary id - or not.
+#
+# After 3.0.3, there are two kinds of types of boundary errors: strict and permissive.
+#
+# If multipart content contains the three necessary lines with correct order, but
+# there are one or more lines with "--", then parser returns with value 2 (non-zero).
+#
+# If some of the necessary lines (usually the start or end) misses, or the order
+# is wrong, then parser returns with value 1 (also a non-zero).
+#
+# You can choose, which one is what you need. The example below contains the
+# 'strict' mode, which means if there are any lines with start of "--", then
+# Coraza blocked the content. But the next, commented example contains
+# the 'permissive' mode, then you check only if the necessary lines exists in
+# correct order. Whit this, you can enable to upload PEM files (eg "----BEGIN.."),
+# or other text files, which contains eg. HTTP headers.
+#
+# The difference is only the operator - in strict mode (first) the content blocked
+# in case of any non-zero value. In permissive mode (second, commented) the
+# content blocked only if the value is explicit 1. If it 0 or 2, the content will
+# allowed.
+#
+
+#
+# See #1747 and #1924 for further information on the possible values for
+# MULTIPART_UNMATCHED_BOUNDARY.
+#
+SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \
+    "id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
+
+# Some internal errors will set flags in TX and we will need to look for these.
+# All of these are prefixed with "MSC_".  The following flags currently exist:
+#
+# COR_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.
+#
+SecRule TX:/^COR_/ "!@streq 0" \
+        "id:'200005',phase:2,t:none,deny,msg:'Coraza internal error flagged: %{MATCHED_VAR_NAME}'"
+
+
+# -- Response body handling --------------------------------------------------
+
+# Allow Coraza to access response bodies.
+# You should have this directive enabled in order to identify errors
+# and data leakage issues.
+#
+# Do keep in mind that enabling this directive does increases both
+# memory consumption and response latency.
+#
+SecResponseBodyAccess On
+
+# Which response MIME types do you want to inspect? You should adjust the
+# configuration below to catch documents but avoid static files
+# (e.g., images and archives).
+#
+SecResponseBodyMimeType text/plain text/html text/xml application/json
+
+# Buffer response bodies of up to 512 KB in length.
+SecResponseBodyLimit 524288
+
+# What happens when we encounter a response body larger than the configured
+# limit? By default, we process what we have and let the rest through.
+# That's somewhat less secure, but does not break any legitimate pages.
+#
+SecResponseBodyLimitAction ProcessPartial
+
+
+# -- Filesystem configuration ------------------------------------------------
+
+# The location where Coraza stores temporary files (for example, when
+# it needs to handle a file upload that is larger than the configured limit).
+#
+# This default setting is chosen due to all systems have /tmp available however,
+# this is less than ideal. It is recommended that you specify a location that's private.
+#
+SecTmpDir /tmp/
+
+# The location where Coraza will keep its persistent data.  This default setting
+# is chosen due to all systems have /tmp available however, it
+# too should be updated to a place that other users can't access.
+#
+SecDataDir /tmp/
+
+
+# -- File uploads handling configuration -------------------------------------
+
+# The location where Coraza stores intercepted uploaded files. This
+# location must be private to Coraza. You don't want other users on
+# the server to access the files, do you?
+#
+#SecUploadDir /opt/coraza/var/upload/
+
+# By default, only keep the files that were determined to be unusual
+# in some way (by an external inspection script). For this to work you
+# will also need at least one file inspection rule.
+#
+#SecUploadKeepFiles RelevantOnly
+
+# Uploaded files are by default created with permissions that do not allow
+# any other user to access them. You may need to relax that if you want to
+# interface Coraza to an external program (e.g., an anti-virus).
+#
+#SecUploadFileMode 0600
+
+
+# -- Debug log configuration -------------------------------------------------
+
+# Default debug log path
+# Debug levels:
+# 0:   No logging (least verbose)
+# 1:   Error
+# 2:   Warn
+# 3:   Info
+# 4-8: Debug
+# 9:   Trace (most verbose)
+# Most logging has not been implemented because it will be replaced with
+# advanced rule profiling options
+#SecDebugLog /opt/coraza/var/log/debug.log
+SecDebugLogLevel 3
+
+
+# -- Audit log configuration -------------------------------------------------
+
+# Log the transactions that are marked by a rule, as well as those that
+# trigger a server error (determined by a 5xx or 4xx, excluding 404,
+# level response status codes).
+#
+SecAuditEngine On
+SecAuditLogRelevantStatus "^(?:(5|4)(0|1)[0-9])$"
+
+# Log everything we know about a transaction.
+SecAuditLogParts ABIJDEFHZ
+
+# Use a single file for logging. This is much easier to look at, but
+# assumes that you will use the audit log only occasionally.
+#
+SecAuditLogType Serial
+
+
+# -- Miscellaneous -----------------------------------------------------------
+
+# Use the most commonly used application/x-www-form-urlencoded parameter
+# separator. There's probably only one application somewhere that uses
+# something else so don't expect to change this value.
+#
+SecArgumentSeparator &
+
+# Settle on version 0 (zero) cookies, as that is what most applications
+# use. Using an incorrect cookie version may open your installation to
+# evasion attacks (against the rules that examine named cookies).
+#
+SecCookieFormat 0

plugins/wasm-go/extensions/waf/wasmplugin/rules/coraza.conf-recommended.conf

@@ -0,0 +1,253 @@
+# -- Rule engine initialization ----------------------------------------------
+
+# Enable Coraza, attaching it to every transaction. Use detection
+# only to start with, because that minimises the chances of post-installation
+# disruption.
+#
+SecRuleEngine DetectionOnly
+
+
+# -- Request body handling ---------------------------------------------------
+
+# Allow Coraza to access request bodies. If you don't, Coraza
+# won't be able to see any POST parameters, which opens a large security
+# hole for attackers to exploit.
+#
+SecRequestBodyAccess On
+
+# Enable XML request body parser.
+# Initiate XML Processor in case of xml content-type
+#
+SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+|/)|text/)xml" \
+     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
+
+# Enable JSON request body parser.
+# Initiate JSON Processor in case of JSON content-type; change accordingly
+# if your application does not use 'application/json'
+#
+SecRule REQUEST_HEADERS:Content-Type "^application/json" \
+     "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
+
+# Sample rule to enable JSON request body parser for more subtypes.
+# Uncomment or adapt this rule if you want to engage the JSON
+# Processor for "+json" subtypes
+#
+#SecRule REQUEST_HEADERS:Content-Type "^application/[a-z0-9.-]+[+]json" \
+#     "id:'200006',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
+
+# Maximum request body size we will accept for buffering. If you support
+# file uploads then the value given on the first line has to be as large
+# as the largest file you are willing to accept. The second value refers
+# to the size of data, with files excluded. You want to keep that value as
+# low as practical.
+#
+SecRequestBodyLimit 13107200
+
+SecRequestBodyInMemoryLimit 131072
+
+SecRequestBodyNoFilesLimit 131072
+
+# What to do if the request body size is above our configured limit.
+# Keep in mind that this setting will automatically be set to ProcessPartial
+# when SecRuleEngine is set to DetectionOnly mode in order to minimize
+# disruptions when initially deploying Coraza.
+#
+SecRequestBodyLimitAction Reject
+
+# Verify that we've correctly processed the request body.
+# As a rule of thumb, when failing to process a request body
+# you should reject the request (when deployed in blocking mode)
+# or log a high-severity alert (when deployed in detection-only mode).
+#
+SecRule REQBODY_ERROR "!@eq 0" \
+"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
+
+# By default be strict with what we accept in the multipart/form-data
+# request body. If the rule below proves to be too strict for your
+# environment consider changing it to detection-only. You are encouraged
+# _not_ to remove it altogether.
+#
+SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
+"id:'200003',phase:2,t:none,log,deny,status:400, \
+msg:'Multipart request body failed strict validation: \
+PE %{REQBODY_PROCESSOR_ERROR}, \
+BQ %{MULTIPART_BOUNDARY_QUOTED}, \
+BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
+DB %{MULTIPART_DATA_BEFORE}, \
+DA %{MULTIPART_DATA_AFTER}, \
+HF %{MULTIPART_HEADER_FOLDING}, \
+LF %{MULTIPART_LF_LINE}, \
+SM %{MULTIPART_MISSING_SEMICOLON}, \
+IQ %{MULTIPART_INVALID_QUOTING}, \
+IP %{MULTIPART_INVALID_PART}, \
+IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
+FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
+
+# Did we see anything that might be a boundary?
+#
+# Here is a short description about the Coraza Multipart parser: the
+# parser returns with value 0, if all "boundary-like" line matches with
+# the boundary string which given in MIME header. In any other cases it returns
+# with different value, eg. 1 or 2.
+#
+# The RFC 1341 descript the multipart content-type and its syntax must contains
+# only three mandatory lines (above the content):
+# * Content-Type: multipart/mixed; boundary=BOUNDARY_STRING
+# * --BOUNDARY_STRING
+# * --BOUNDARY_STRING--
+#
+# First line indicates, that this is a multipart content, second shows that
+# here starts a part of the multipart content, third shows the end of content.
+#
+# If there are any other lines, which starts with "--", then it should be
+# another boundary id - or not.
+#
+# After 3.0.3, there are two kinds of types of boundary errors: strict and permissive.
+#
+# If multipart content contains the three necessary lines with correct order, but
+# there are one or more lines with "--", then parser returns with value 2 (non-zero).
+#
+# If some of the necessary lines (usually the start or end) misses, or the order
+# is wrong, then parser returns with value 1 (also a non-zero).
+#
+# You can choose, which one is what you need. The example below contains the
+# 'strict' mode, which means if there are any lines with start of "--", then
+# Coraza blocked the content. But the next, commented example contains
+# the 'permissive' mode, then you check only if the necessary lines exists in
+# correct order. Whit this, you can enable to upload PEM files (eg "----BEGIN.."),
+# or other text files, which contains eg. HTTP headers.
+#
+# The difference is only the operator - in strict mode (first) the content blocked
+# in case of any non-zero value. In permissive mode (second, commented) the
+# content blocked only if the value is explicit 1. If it 0 or 2, the content will
+# allowed.
+#
+
+#
+# See #1747 and #1924 for further information on the possible values for
+# MULTIPART_UNMATCHED_BOUNDARY.
+#
+SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \
+    "id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
+
+# Some internal errors will set flags in TX and we will need to look for these.
+# All of these are prefixed with "MSC_".  The following flags currently exist:
+#
+# COR_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.
+#
+SecRule TX:/^COR_/ "!@streq 0" \
+        "id:'200005',phase:2,t:none,deny,msg:'Coraza internal error flagged: %{MATCHED_VAR_NAME}'"
+
+
+# -- Response body handling --------------------------------------------------
+
+# Allow Coraza to access response bodies.
+# You should have this directive enabled in order to identify errors
+# and data leakage issues.
+#
+# Do keep in mind that enabling this directive does increases both
+# memory consumption and response latency.
+#
+SecResponseBodyAccess On
+
+# Which response MIME types do you want to inspect? You should adjust the
+# configuration below to catch documents but avoid static files
+# (e.g., images and archives).
+#
+SecResponseBodyMimeType text/plain text/html text/xml
+
+# Buffer response bodies of up to 512 KB in length.
+SecResponseBodyLimit 524288
+
+# What happens when we encounter a response body larger than the configured
+# limit? By default, we process what we have and let the rest through.
+# That's somewhat less secure, but does not break any legitimate pages.
+#
+SecResponseBodyLimitAction ProcessPartial
+
+
+# -- Filesystem configuration ------------------------------------------------
+
+# The location where Coraza stores temporary files (for example, when
+# it needs to handle a file upload that is larger than the configured limit).
+#
+# This default setting is chosen due to all systems have /tmp available however,
+# this is less than ideal. It is recommended that you specify a location that's private.
+#
+SecTmpDir /tmp/
+
+# The location where Coraza will keep its persistent data.  This default setting
+# is chosen due to all systems have /tmp available however, it
+# too should be updated to a place that other users can't access.
+#
+SecDataDir /tmp/
+
+
+# -- File uploads handling configuration -------------------------------------
+
+# The location where Coraza stores intercepted uploaded files. This
+# location must be private to Coraza. You don't want other users on
+# the server to access the files, do you?
+#
+#SecUploadDir /opt/coraza/var/upload/
+
+# By default, only keep the files that were determined to be unusual
+# in some way (by an external inspection script). For this to work you
+# will also need at least one file inspection rule.
+#
+#SecUploadKeepFiles RelevantOnly
+
+# Uploaded files are by default created with permissions that do not allow
+# any other user to access them. You may need to relax that if you want to
+# interface Coraza to an external program (e.g., an anti-virus).
+#
+#SecUploadFileMode 0600
+
+
+# -- Debug log configuration -------------------------------------------------
+
+# Default debug log path
+# Debug levels:
+# 0:   No logging (least verbose)
+# 1:   Error
+# 2:   Warn
+# 3:   Info
+# 4-8: Debug
+# 9:   Trace (most verbose)
+# Most logging has not been implemented because it will be replaced with
+# advanced rule profiling options
+#SecDebugLog /opt/coraza/var/log/debug.log
+#SecDebugLogLevel 3
+
+
+# -- Audit log configuration -------------------------------------------------
+
+# Log the transactions that are marked by a rule, as well as those that
+# trigger a server error (determined by a 5xx or 4xx, excluding 404,
+# level response status codes).
+#
+SecAuditEngine RelevantOnly
+SecAuditLogRelevantStatus "^(?:(5|4)(0|1)[0-9])$"
+
+# Log everything we know about a transaction.
+SecAuditLogParts ABIJDEFHZ
+
+# Use a single file for logging. This is much easier to look at, but
+# assumes that you will use the audit log only occasionally.
+#
+SecAuditLogType Serial
+
+
+# -- Miscellaneous -----------------------------------------------------------
+
+# Use the most commonly used application/x-www-form-urlencoded parameter
+# separator. There's probably only one application somewhere that uses
+# something else so don't expect to change this value.
+#
+SecArgumentSeparator &
+
+# Settle on version 0 (zero) cookies, as that is what most applications
+# use. Using an incorrect cookie version may open your installation to
+# evasion attacks (against the rules that examine named cookies).
+#
+SecCookieFormat 0

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs-setup-demo.conf

@@ -0,0 +1,727 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+
+#
+# -- [[ Introduction ]] --------------------------------------------------------
+#
+# The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack
+# detection rules that provide a base level of protection for any web
+# application. They are written for the open source, cross-platform
+# ModSecurity Web Application Firewall.
+#
+# See also:
+# https://coreruleset.org/
+# https://github.com/coreruleset/coreruleset
+# https://owasp.org/www-project-modsecurity-core-rule-set/
+#
+
+
+#
+# -- [[ System Requirements ]] -------------------------------------------------
+#
+# CRS requires ModSecurity version 2.8.0 or above.
+# We recommend to always use the newest ModSecurity version.
+#
+# The configuration directives/settings in this file are used to control
+# the OWASP ModSecurity CRS. These settings do **NOT** configure the main
+# ModSecurity settings (modsecurity.conf) such as SecRuleEngine,
+# SecRequestBodyAccess, SecAuditEngine, SecDebugLog, and XML processing.
+#
+# The CRS assumes that modsecurity.conf has been loaded. It is bundled with
+# ModSecurity. If you don't have it, you can get it from:
+# 2.x: https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v2/master/modsecurity.conf-recommended
+# 3.x: https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended
+#
+# The order of file inclusion in your webserver configuration should always be:
+# 1. modsecurity.conf
+# 2. crs-setup.conf (this file)
+# 3. rules/*.conf (the CRS rule files)
+#
+# Please refer to the INSTALL file for detailed installation instructions.
+#
+
+
+#
+# -- [[ Mode of Operation: Anomaly Scoring vs. Self-Contained ]] ---------------
+#
+# The CRS can run in two modes:
+#
+# -- [[ Anomaly Scoring Mode (default) ]] --
+# In CRS3, anomaly mode is the default and recommended mode, since it gives the
+# most accurate log information and offers the most flexibility in setting your
+# blocking policies. It is also called "collaborative detection mode".
+# In this mode, each matching rule increases an 'anomaly score'.
+# At the conclusion of the inbound rules, and again at the conclusion of the
+# outbound rules, the anomaly score is checked, and the blocking evaluation
+# rules apply a disruptive action, by default returning an error 403.
+#
+# -- [[ Self-Contained Mode ]] --
+# In this mode, rules apply an action instantly. This was the CRS2 default.
+# It can lower resource usage, at the cost of less flexibility in blocking policy
+# and less informative audit logs (only the first detected threat is logged).
+# Rules inherit the disruptive action that you specify (i.e. deny, drop, etc).
+# The first rule that matches will execute this action. In most cases this will
+# cause evaluation to stop after the first rule has matched, similar to how many
+# IDSs function.
+#
+# -- [[ Alert Logging Control ]] --
+# In the mode configuration, you must also adjust the desired logging options.
+# There are three common options for dealing with logging. By default CRS enables
+# logging to the webserver error log (or Event viewer) plus detailed logging to
+# the ModSecurity audit log (configured under SecAuditLog in modsecurity.conf).
+#
+# - To log to both error log and ModSecurity audit log file, use: "log,auditlog"
+# - To log *only* to the ModSecurity audit log file, use: "nolog,auditlog"
+# - To log *only* to the error log file, use: "log,noauditlog"
+#
+# Examples for the various modes follow.
+# You must leave one of the following options enabled.
+# Note that you must specify the same line for phase:1 and phase:2.
+#
+
+# Default: Anomaly Scoring mode, log to error log, log to ModSecurity audit log
+# - By default, offending requests are blocked with an error 403 response.
+# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example
+#   and review section 'Changing the Disruptive Action for Anomaly Mode'.
+# - In Apache, you can use ErrorDocument to show a friendly error page or
+#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+#
+SecDefaultAction "phase:1,log,auditlog,pass"
+SecDefaultAction "phase:2,log,auditlog,pass"
+
+# Example: Anomaly Scoring mode, log only to ModSecurity audit log
+# - By default, offending requests are blocked with an error 403 response.
+# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example
+#   and review section 'Changing the Disruptive Action for Anomaly Mode'.
+# - In Apache, you can use ErrorDocument to show a friendly error page or
+#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+#
+# SecDefaultAction "phase:1,nolog,auditlog,pass"
+# SecDefaultAction "phase:2,nolog,auditlog,pass"
+
+# Example: Self-contained mode, return error 403 on blocking
+# - In this configuration the default disruptive action becomes 'deny'. After a
+#   rule triggers, it will stop processing the request and return an error 403.
+# - You can also use a different error status, such as 404, 406, et cetera.
+# - In Apache, you can use ErrorDocument to show a friendly error page or
+#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+#
+# SecDefaultAction "phase:1,log,auditlog,deny,status:403"
+# SecDefaultAction "phase:2,log,auditlog,deny,status:403"
+
+# Example: Self-contained mode, redirect back to homepage on blocking
+# - In this configuration the 'tag' action includes the Host header data in the
+#   log. This helps to identify which virtual host triggered the rule (if any).
+# - Note that this might cause redirect loops in some situations; for example
+#   if a Cookie or User-Agent header is blocked, it will also be blocked when
+#   the client subsequently tries to access the homepage. You can also redirect
+#   to another custom URL.
+# SecDefaultAction "phase:1,log,auditlog,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'"
+# SecDefaultAction "phase:2,log,auditlog,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'"
+
+
+#
+# -- [[ Paranoia Level Initialization ]] ---------------------------------------
+#
+# The Paranoia Level (PL) setting allows you to choose the desired level
+# of rule checks that will add to your anomaly scores.
+#
+# With each paranoia level increase, the CRS enables additional rules
+# giving you a higher level of security. However, higher paranoia levels
+# also increase the possibility of blocking some legitimate traffic due to
+# false alarms (also named false positives or FPs). If you use higher
+# paranoia levels, it is likely that you will need to add some exclusion
+# rules for certain requests and applications receiving complex input.
+#
+# - A paranoia level of 1 is default. In this level, most core rules
+#   are enabled. PL1 is advised for beginners, installations
+#   covering many different sites and applications, and for setups
+#   with standard security requirements.
+#   At PL1 you should face FPs rarely. If you encounter FPs, please
+#   open an issue on the CRS GitHub site and don't forget to attach your
+#   complete Audit Log record for the request with the issue.
+# - Paranoia level 2 includes many extra rules, for instance enabling
+#   many regexp-based SQL and XSS injection protections, and adding
+#   extra keywords checked for code injections. PL2 is advised
+#   for moderate to experienced users desiring more complete coverage
+#   and for installations with elevated security requirements.
+#   PL2 comes with some FPs which you need to handle.
+# - Paranoia level 3 enables more rules and keyword lists, and tweaks
+#   limits on special characters used. PL3 is aimed at users experienced
+#   at the handling of FPs and at installations with a high security
+#   requirement.
+# - Paranoia level 4 further restricts special characters.
+#   The highest level is advised for experienced users protecting
+#   installations with very high security requirements. Running PL4 will
+#   likely produce a very high number of FPs which have to be
+#   treated before the site can go productive.
+#
+# All rules will log their PL to the audit log;
+# example: [tag "paranoia-level/2"]. This allows you to deduct from the
+# audit log how the WAF behavior is affected by paranoia level.
+#
+# It is important to also look into the variable
+# tx.enforce_bodyproc_urlencoded (Enforce Body Processor URLENCODED)
+# defined below. Enabling it closes a possible bypass of CRS.
+#
+# Uncomment this rule to change the default:
+#
+SecAction \
+   "id:900000,\
+   phase:1,\
+   pass,\
+   t:none,\
+   nolog,\
+   setvar:tx.blocking_paranoia_level=1"
+
+
+# It is possible to execute rules from a higher paranoia level but not include
+# them in the anomaly scoring. This allows you to take a well-tuned system on
+# paranoia level 1 and add rules from paranoia level 2 without having to fear
+# the new rules would lead to false positives that raise your score above the
+# threshold.
+# This optional feature is enabled by uncommenting the following rule and
+# setting the tx.detection_paranoia_level.
+# Technically, rules up to the level defined in tx.detection_paranoia_level
+# will be executed, but only the rules up to tx.blocking_paranoia_level affect the
+# anomaly scores.
+# By default, tx.detection_paranoia_level is set to tx.blocking_paranoia_level.
+# tx.detection_paranoia_level must not be lower than tx.blocking_paranoia_level.
+#
+# Please notice that setting tx.detection_paranoia_level to a higher paranoia
+# level results in a performance impact that is equally high as setting
+# tx.blocking_paranoia_level to said level.
+#
+#SecAction \
+#    "id:900001,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.detection_paranoia_level=1"
+
+
+#
+# -- [[ Enforce Body Processor URLENCODED ]] -----------------------------------
+#
+# ModSecurity selects the body processor based on the Content-Type request
+# header. But clients are not always setting the Content-Type header for their
+# request body payloads. This will leave ModSecurity with limited vision into
+# the payload.  The variable tx.enforce_bodyproc_urlencoded lets you force the
+# URLENCODED body processor in these situations. This is off by default, as it
+# implies a change of the behaviour of ModSecurity beyond CRS (the body
+# processor applies to all rules, not only CRS) and because it may lead to
+# false positives already on paranoia level 1. However, enabling this variable
+# closes a possible bypass of CRS so it should be considered.
+#
+# Uncomment this rule to change the default:
+#
+#SecAction \
+#    "id:900010,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.enforce_bodyproc_urlencoded=1"
+
+
+#
+# -- [[ Anomaly Scoring Mode Severity Levels ]] --------------------------------
+#
+# Each rule in the CRS has an associated severity level.
+# These are the default scoring points for each severity level.
+# These settings will be used to increment the anomaly score if a rule matches.
+# You may adjust these points to your liking, but this is usually not needed.
+#
+# - CRITICAL severity: Anomaly Score of 5.
+#       Mostly generated by the application attack rules (93x and 94x files).
+# - ERROR severity: Anomaly Score of 4.
+#       Generated mostly from outbound leakage rules (95x files).
+# - WARNING severity: Anomaly Score of 3.
+#       Generated mostly by malicious client rules (91x files).
+# - NOTICE severity: Anomaly Score of 2.
+#       Generated mostly by the protocol rules (92x files).
+#
+# In anomaly mode, these scores are cumulative.
+# So it's possible for a request to hit multiple rules.
+#
+# (Note: In this file, we use 'phase:1' to set CRS configuration variables.
+# In general, 'phase:request' is used. However, we want to make absolutely sure
+# that all configuration variables are set before the CRS rules are processed.)
+#
+SecAction \
+   "id:900100,\
+   phase:1,\
+   pass,\
+   t:none,\
+   nolog,\
+   setvar:tx.critical_anomaly_score=5,\
+   setvar:tx.error_anomaly_score=4,\
+   setvar:tx.warning_anomaly_score=3,\
+   setvar:tx.notice_anomaly_score=2"
+
+
+#
+# -- [[ Anomaly Scoring Mode Blocking Threshold Levels ]] ----------------------
+#
+# Here, you can specify at which cumulative anomaly score an inbound request,
+# or outbound response, gets blocked.
+#
+# Most detected inbound threats will give a critical score of 5.
+# Smaller violations, like violations of protocol/standards, carry lower scores.
+#
+# [ At default value ]
+# If you keep the blocking thresholds at the defaults, the CRS will work
+# similarly to previous CRS versions: a single critical rule match will cause
+# the request to be blocked and logged.
+#
+# [ Using higher values ]
+# If you want to make the CRS less sensitive, you can increase the blocking
+# thresholds, for instance to 7 (which would require multiple rule matches
+# before blocking) or 10 (which would require at least two critical alerts - or
+# a combination of many lesser alerts), or even higher. However, increasing the
+# thresholds might cause some attacks to bypass the CRS rules or your policies.
+#
+# [ New deployment strategy: Starting high and decreasing ]
+# It is a common practice to start a fresh CRS installation with elevated
+# anomaly scoring thresholds (>100) and then lower the limits as your
+# confidence in the setup grows. You may also look into the Sampling
+# Percentage section below for a different strategy to ease into a new
+# CRS installation.
+#
+# [ Anomaly Threshold / Paranoia Level Quadrant ]
+#
+#     High Anomaly Limit   |   High Anomaly Limit
+#     Low Paranoia Level   |   High Paranoia Level
+#     -> Fresh Site        |   -> Experimental Site
+# ------------------------------------------------------
+#     Low Anomaly Limit    |   Low Anomaly Limit
+#     Low Paranoia Level   |   High Paranoia Level
+#     -> Standard Site     |   -> High Security Site
+#
+# Uncomment this rule to change the defaults:
+#
+#SecAction \
+#    "id:900110,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.inbound_anomaly_score_threshold=5,\
+#    setvar:tx.outbound_anomaly_score_threshold=4"
+
+
+#
+# -- [[ Application Specific Rule Exclusions ]] --------------------------------
+#
+# CRS 3.x contained exclusion packages to tweak the CRS for use with common
+# web applications, lowering the number of false positives.
+#
+# In CRS 4, these are no longer part of the CRS itself, but they are available
+# as "CRS plugins". Some plugins improve support for web applications, and others
+# may bring new functionality. Plugins are not installed by default, but can be
+# downloaded from the plugin registry:
+# https://github.com/coreruleset/plugin-registry
+#
+# For detailed information about using and installing plugins, please see:
+# https://coreruleset.org/docs/concepts/plugins/
+
+
+#
+# -- [[ Anomaly Score Reporting Level ]] ---------------------------------------
+#
+# When a request is blocked due to the anomaly score meeting or exceeding the
+# anomaly threshold then the blocking rule will also report the anomaly score.
+# This applies to the separate inbound and outbound anomaly scores.
+#
+# In phase 5, there are additional rules that can perform additional reporting
+# of anomaly scores with a verbosity that depends on the reporting level defined
+# below.
+#
+# By setting the reporting level you control whether you want additional
+# reporting beyond the blocking rule or not and, if yes, which requests should
+# be covered. The higher the reporting level, the more verbose the reporting is.
+#
+# There are 6 reporting levels:
+#
+# 0 - Reporting disabled
+# 1 - Reporting for requests with a blocking anomaly score >= a threshold
+# 2 - Reporting for requests with a detection anomaly score >= a threshold
+# 3 - Reporting for requests with a blocking anomaly score greater than 0
+# 4 - Reporting for requests with a detection anomaly score greater than 0
+# 5 - Reporting for all requests
+#
+# Note: Reporting levels 1 and 2 make it possible to differentiate between
+# requests that are blocked and requests that are *not* blocked but would have
+# been blocked if the blocking PL was equal to detection PL. This may be useful
+# for certain FP tuning methodologies, for example moving to a higher PL.
+#
+# A value of 5 can be useful on platforms where you are interested in logging
+# non-scoring requests, yet it is not possible to report this information in
+# the request/access log. This applies to Nginx, for example.
+#
+#SecAction \
+#    "id:900115,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.reporting_level=4"
+
+
+#
+# -- [[ Early Anomaly Scoring Mode Blocking ]] ------------------------------
+#
+# The anomaly scores for the request and the responses are generally summed up
+# and evaluated at the end of phase:2 and at the end of phase:4 respectively.
+# However, it is possible to enable an early evaluation of these anomaly scores
+# at the end of phase:1 and at the end of phase:3.
+#
+# If a request (or a response) hits the anomaly threshold in this early
+# evaluation, then blocking happens immediately (if blocking is enabled) and
+# the phase 2 (and phase 4 respectively) will no longer be executed.
+#
+# Enable the rule 900120 that sets the variable tx.early_blocking to 1 in order
+# to enable early blocking. The variable tx.early_blocking is set to 0 by
+# default. Early blocking is thus disabled by default.
+#
+# Please note that early blocking will hide potential alerts from you. This
+# means that a payload that would appear in an alert in phase 2 (or phase 4)
+# does not get evaluated if the request is being blocked early. So when you
+# disabled early blocking again at some point in the future, then new alerts
+# from phase 2 might pop up.
+SecAction \
+    "id:900120,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:tx.early_blocking=1"
+
+
+#
+# -- [[ HTTP Policy Settings ]] ------------------------------------------------
+#
+# This section defines your policies for the HTTP protocol, such as:
+# - allowed HTTP versions, HTTP methods, allowed request Content-Types
+# - forbidden file extensions (e.g. .bak, .sql) and request headers (e.g. Proxy)
+#
+# These variables are used in the following rule files:
+# - REQUEST-911-METHOD-ENFORCEMENT.conf
+# - REQUEST-920-PROTOCOL-ENFORCEMENT.conf
+
+# HTTP methods that a client is allowed to use.
+# Default: GET HEAD POST OPTIONS
+# Example: for RESTful APIs, add the following methods: PUT PATCH DELETE
+# Example: for WebDAV, add the following methods: CHECKOUT COPY DELETE LOCK
+#          MERGE MKACTIVITY MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900200,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
+
+# Content-Types that a client is allowed to send in a request.
+# Default: |application/x-www-form-urlencoded| |multipart/form-data| |multipart/related|
+# |text/xml| |application/xml| |application/soap+xml| |application/json|
+# |application/cloudevents+json| |application/cloudevents-batch+json|
+#
+# Please note, that the rule where CRS uses this variable (920420) evaluates it with operator
+# `@within`, which is case sensitive, but uses t:lowercase. You must add your whole custom
+# Content-Type with lowercase.
+#
+# Bypass Warning: some applications may not rely on the content-type request header in order
+# to parse the request body. This could make an attacker able to send malicious URLENCODED/JSON/XML
+# payloads without being detected by the WAF. Allowing request content-type that doesn't activate any
+# body processor (for example: "text/plain", "application/x-amf", "application/octet-stream", etc..)
+# could lead to a WAF bypass. For example, a malicious JSON payload submitted with a "text/plain"
+# content type may still be interpreted as JSON by a backend application but would not trigger the
+# JSON body parser at the WAF, leading to a bypass.
+#
+# To prevent blocking request with not allowed content-type by default, you can create an exclusion
+# rule that removes rule 920420. For example:
+#SecRule REQUEST_HEADERS:Content-Type "@rx ^text/plain" \
+#    "id:1234,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    ctl:ruleRemoveById=920420,\
+#    chain"
+#    SecRule REQUEST_URI "@rx ^/foo/bar" "t:none"
+#
+# Uncomment this rule to change the default.
+#
+#SecAction \
+#    "id:900220,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"
+
+# Allowed HTTP versions.
+# Default: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0
+# Example for legacy clients: HTTP/0.9 HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0
+# Note that some web server versions use 'HTTP/2', some 'HTTP/2.0', so
+# we include both version strings by default.
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900230,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0'"
+
+# Forbidden file extensions.
+# Guards against unintended exposure of development/configuration files.
+# Default: .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/
+# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .rdb/ .sql/
+# Note that .axd was removed due to false positives (see PR 1925).
+#
+# To additionally guard against configuration/install archive files from being
+# accidentally exposed, common archive file extensions can be added to the
+# restricted extensions list. An example list of common archive file extensions
+# is presented below:
+# .7z/ .br/ .bz/ .bz2/ .cab/ .cpio/ .gz/ .img/ .iso/ .jar/ .rar/ .tar/ .tbz2/ .tgz/ .txz/ .xz/ .zip/ .zst/
+# (Source: https://en.wikipedia.org/wiki/List_of_archive_formats)
+#
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900240,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
+
+# Forbidden request headers.
+# Header names should be lowercase, enclosed by /slashes/ as delimiters.
+# Default: /accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/
+#
+# Note: Accept-Charset is a deprecated header that should not be used by clients and
+# ignored by servers. It can be used for a response WAF bypass, by asking for a charset
+# that the WAF cannot decode.
+# Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset
+#
+# Note: Content-Encoding is used to list any encodings that have been applied to the
+# original payload. It is only used for compression, which isn't supported by CRS by
+# default since it blocks newlines and null bytes inside the request body. Most
+# compression algorithms require at least null bytes per RFC. Blocking it shouldn't
+# break anything and increases security since ModSecurity is incapable of properly
+# scanning compressed request bodies.
+#
+# Note: Blocking Proxy header prevents 'httpoxy' vulnerability: https://httpoxy.org
+#
+# Note: Blocking the x-http-method-override,x-http-method and x-method-override headers
+# prevents attacks as described here: https://www.sidechannel.blog/en/http-method-override-what-it-is-and-how-a-pentester-can-use-it
+#
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900250,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.restricted_headers=/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
+
+# Content-Types charsets that a client is allowed to send in a request.
+# The content-types are enclosed by |pipes| as delimiters to guarantee exact matches.
+# Default: |utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900280,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"
+
+#
+# -- [[ HTTP Argument/Upload Limits ]] -----------------------------------------
+#
+# Here you can define optional limits on HTTP get/post parameters and uploads.
+# This can help to prevent application specific DoS attacks.
+#
+# These values are checked in REQUEST-920-PROTOCOL-ENFORCEMENT.conf.
+# Beware of blocking legitimate traffic when enabling these limits.
+#
+
+# Block request if number of arguments is too high
+# Default: unlimited
+# Example: 255
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900300,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.max_num_args=255"
+
+# Block request if the length of any argument name is too high
+# Default: unlimited
+# Example: 100
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900310,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.arg_name_length=100"
+
+# Block request if the length of any argument value is too high
+# Default: unlimited
+# Example: 400
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900320,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.arg_length=400"
+
+# Block request if the total length of all combined arguments is too high
+# Default: unlimited
+# Example: 64000
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900330,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.total_arg_length=64000"
+
+# Block request if the file size of any individual uploaded file is too high
+# Default: unlimited
+# Example: 1048576
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900340,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.max_file_size=1048576"
+
+# Block request if the total size of all combined uploaded files is too high
+# Default: unlimited
+# Example: 1048576
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900350,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.combined_file_sizes=1048576"
+
+
+#
+# -- [[ Easing In / Sampling Percentage ]] -------------------------------------
+#
+# Adding the Core Rule Set to an existing productive site can lead to false
+# positives, unexpected performance issues and other undesired side effects.
+#
+# It can be beneficial to test the water first by enabling the CRS for a
+# limited number of requests only and then, when you have solved the issues (if
+# any) and you have confidence in the setup, to raise the ratio of requests
+# being sent into the ruleset.
+#
+# Adjust the percentage of requests that are funnelled into the Core Rules by
+# setting TX.sampling_percentage below. The default is 100, meaning that every
+# request gets checked by the CRS.  The selection of requests, which are going
+# to be checked, is based on a pseudo random number generated by ModSecurity.
+#
+# If a request is allowed to pass without being checked by the CRS, there is no
+# entry in the audit log (for performance reasons), but an error log entry is
+# written.  If you want to disable the error log entry, then issue the
+# following directive somewhere after the inclusion of the CRS
+# (E.g., RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf).
+#
+#SecRuleUpdateActionById 901450 "nolog"
+#
+# ATTENTION: If this TX.sampling_percentage is below 100, then some of the
+# requests will bypass the Core Rules completely and you lose the ability to
+# protect your service with ModSecurity.
+#
+# Uncomment this rule to enable this feature:
+#
+#SecAction \
+#    "id:900400,\
+#    phase:1,\
+#    pass,\
+#    nolog,\
+#    setvar:tx.sampling_percentage=100"
+
+
+
+#
+# -- [[ Check UTF-8 encoding ]] ------------------------------------------------
+#
+# The CRS can optionally check request contents for invalid UTF-8 encoding.
+# We only want to apply this check if UTF-8 encoding is actually used by the
+# site; otherwise it will result in false positives.
+#
+# Uncomment this rule to use this feature:
+#
+#SecAction \
+#    "id:900950,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.crs_validate_utf8_encoding=1"
+
+
+#
+# -- [[ Collection timeout ]] --------------------------------------------------
+#
+# Set the SecCollectionTimeout directive from the ModSecurity default (1 hour)
+# to a lower setting which is appropriate to most sites.
+# This increases performance by cleaning out stale collection (block) entries.
+#
+# This value should be greater than or equal to any block durations or timeouts
+# set by plugins that make use of ModSecurity's persistent collections (e.g. the
+# DoS protection and IP reputation plugins).
+#
+# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecCollectionTimeout
+
+# Please keep this directive uncommented.
+# Default: 600 (10 minutes)
+SecCollectionTimeout 600
+
+
+#
+# -- [[ End of setup ]] --------------------------------------------------------
+#
+# The CRS checks the tx.crs_setup_version variable to ensure that the setup
+# has been loaded. If you are not planning to use this setup template,
+# you must manually set the tx.crs_setup_version variable before including
+# the CRS rules/* files.
+#
+# The variable is a numerical representation of the CRS version number.
+# E.g., v3.0.0 is represented as 300.
+#
+SecAction \
+    "id:900990,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:tx.crs_setup_version=400"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs-setup.conf.example

@@ -0,0 +1,727 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+
+#
+# -- [[ Introduction ]] --------------------------------------------------------
+#
+# The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack
+# detection rules that provide a base level of protection for any web
+# application. They are written for the open source, cross-platform
+# ModSecurity Web Application Firewall.
+#
+# See also:
+# https://coreruleset.org/
+# https://github.com/coreruleset/coreruleset
+# https://owasp.org/www-project-modsecurity-core-rule-set/
+#
+
+
+#
+# -- [[ System Requirements ]] -------------------------------------------------
+#
+# CRS requires ModSecurity version 2.8.0 or above.
+# We recommend to always use the newest ModSecurity version.
+#
+# The configuration directives/settings in this file are used to control
+# the OWASP ModSecurity CRS. These settings do **NOT** configure the main
+# ModSecurity settings (modsecurity.conf) such as SecRuleEngine,
+# SecRequestBodyAccess, SecAuditEngine, SecDebugLog, and XML processing.
+#
+# The CRS assumes that modsecurity.conf has been loaded. It is bundled with
+# ModSecurity. If you don't have it, you can get it from:
+# 2.x: https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v2/master/modsecurity.conf-recommended
+# 3.x: https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended
+#
+# The order of file inclusion in your webserver configuration should always be:
+# 1. modsecurity.conf
+# 2. crs-setup.conf (this file)
+# 3. rules/*.conf (the CRS rule files)
+#
+# Please refer to the INSTALL file for detailed installation instructions.
+#
+
+
+#
+# -- [[ Mode of Operation: Anomaly Scoring vs. Self-Contained ]] ---------------
+#
+# The CRS can run in two modes:
+#
+# -- [[ Anomaly Scoring Mode (default) ]] --
+# In CRS3, anomaly mode is the default and recommended mode, since it gives the
+# most accurate log information and offers the most flexibility in setting your
+# blocking policies. It is also called "collaborative detection mode".
+# In this mode, each matching rule increases an 'anomaly score'.
+# At the conclusion of the inbound rules, and again at the conclusion of the
+# outbound rules, the anomaly score is checked, and the blocking evaluation
+# rules apply a disruptive action, by default returning an error 403.
+#
+# -- [[ Self-Contained Mode ]] --
+# In this mode, rules apply an action instantly. This was the CRS2 default.
+# It can lower resource usage, at the cost of less flexibility in blocking policy
+# and less informative audit logs (only the first detected threat is logged).
+# Rules inherit the disruptive action that you specify (i.e. deny, drop, etc).
+# The first rule that matches will execute this action. In most cases this will
+# cause evaluation to stop after the first rule has matched, similar to how many
+# IDSs function.
+#
+# -- [[ Alert Logging Control ]] --
+# In the mode configuration, you must also adjust the desired logging options.
+# There are three common options for dealing with logging. By default CRS enables
+# logging to the webserver error log (or Event viewer) plus detailed logging to
+# the ModSecurity audit log (configured under SecAuditLog in modsecurity.conf).
+#
+# - To log to both error log and ModSecurity audit log file, use: "log,auditlog"
+# - To log *only* to the ModSecurity audit log file, use: "nolog,auditlog"
+# - To log *only* to the error log file, use: "log,noauditlog"
+#
+# Examples for the various modes follow.
+# You must leave one of the following options enabled.
+# Note that you must specify the same line for phase:1 and phase:2.
+#
+
+# Default: Anomaly Scoring mode, log to error log, log to ModSecurity audit log
+# - By default, offending requests are blocked with an error 403 response.
+# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example
+#   and review section 'Changing the Disruptive Action for Anomaly Mode'.
+# - In Apache, you can use ErrorDocument to show a friendly error page or
+#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+#
+SecDefaultAction "phase:1,log,auditlog,pass"
+SecDefaultAction "phase:2,log,auditlog,pass"
+
+# Example: Anomaly Scoring mode, log only to ModSecurity audit log
+# - By default, offending requests are blocked with an error 403 response.
+# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example
+#   and review section 'Changing the Disruptive Action for Anomaly Mode'.
+# - In Apache, you can use ErrorDocument to show a friendly error page or
+#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+#
+# SecDefaultAction "phase:1,nolog,auditlog,pass"
+# SecDefaultAction "phase:2,nolog,auditlog,pass"
+
+# Example: Self-contained mode, return error 403 on blocking
+# - In this configuration the default disruptive action becomes 'deny'. After a
+#   rule triggers, it will stop processing the request and return an error 403.
+# - You can also use a different error status, such as 404, 406, et cetera.
+# - In Apache, you can use ErrorDocument to show a friendly error page or
+#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
+#
+# SecDefaultAction "phase:1,log,auditlog,deny,status:403"
+# SecDefaultAction "phase:2,log,auditlog,deny,status:403"
+
+# Example: Self-contained mode, redirect back to homepage on blocking
+# - In this configuration the 'tag' action includes the Host header data in the
+#   log. This helps to identify which virtual host triggered the rule (if any).
+# - Note that this might cause redirect loops in some situations; for example
+#   if a Cookie or User-Agent header is blocked, it will also be blocked when
+#   the client subsequently tries to access the homepage. You can also redirect
+#   to another custom URL.
+# SecDefaultAction "phase:1,log,auditlog,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'"
+# SecDefaultAction "phase:2,log,auditlog,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'"
+
+
+#
+# -- [[ Paranoia Level Initialization ]] ---------------------------------------
+#
+# The Paranoia Level (PL) setting allows you to choose the desired level
+# of rule checks that will add to your anomaly scores.
+#
+# With each paranoia level increase, the CRS enables additional rules
+# giving you a higher level of security. However, higher paranoia levels
+# also increase the possibility of blocking some legitimate traffic due to
+# false alarms (also named false positives or FPs). If you use higher
+# paranoia levels, it is likely that you will need to add some exclusion
+# rules for certain requests and applications receiving complex input.
+#
+# - A paranoia level of 1 is default. In this level, most core rules
+#   are enabled. PL1 is advised for beginners, installations
+#   covering many different sites and applications, and for setups
+#   with standard security requirements.
+#   At PL1 you should face FPs rarely. If you encounter FPs, please
+#   open an issue on the CRS GitHub site and don't forget to attach your
+#   complete Audit Log record for the request with the issue.
+# - Paranoia level 2 includes many extra rules, for instance enabling
+#   many regexp-based SQL and XSS injection protections, and adding
+#   extra keywords checked for code injections. PL2 is advised
+#   for moderate to experienced users desiring more complete coverage
+#   and for installations with elevated security requirements.
+#   PL2 comes with some FPs which you need to handle.
+# - Paranoia level 3 enables more rules and keyword lists, and tweaks
+#   limits on special characters used. PL3 is aimed at users experienced
+#   at the handling of FPs and at installations with a high security
+#   requirement.
+# - Paranoia level 4 further restricts special characters.
+#   The highest level is advised for experienced users protecting
+#   installations with very high security requirements. Running PL4 will
+#   likely produce a very high number of FPs which have to be
+#   treated before the site can go productive.
+#
+# All rules will log their PL to the audit log;
+# example: [tag "paranoia-level/2"]. This allows you to deduct from the
+# audit log how the WAF behavior is affected by paranoia level.
+#
+# It is important to also look into the variable
+# tx.enforce_bodyproc_urlencoded (Enforce Body Processor URLENCODED)
+# defined below. Enabling it closes a possible bypass of CRS.
+#
+# Uncomment this rule to change the default:
+#
+#SecAction \
+#    "id:900000,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.blocking_paranoia_level=1"
+
+
+# It is possible to execute rules from a higher paranoia level but not include
+# them in the anomaly scoring. This allows you to take a well-tuned system on
+# paranoia level 1 and add rules from paranoia level 2 without having to fear
+# the new rules would lead to false positives that raise your score above the
+# threshold.
+# This optional feature is enabled by uncommenting the following rule and
+# setting the tx.detection_paranoia_level.
+# Technically, rules up to the level defined in tx.detection_paranoia_level
+# will be executed, but only the rules up to tx.blocking_paranoia_level affect the
+# anomaly scores.
+# By default, tx.detection_paranoia_level is set to tx.blocking_paranoia_level.
+# tx.detection_paranoia_level must not be lower than tx.blocking_paranoia_level.
+#
+# Please notice that setting tx.detection_paranoia_level to a higher paranoia
+# level results in a performance impact that is equally high as setting
+# tx.blocking_paranoia_level to said level.
+#
+#SecAction \
+#    "id:900001,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.detection_paranoia_level=1"
+
+
+#
+# -- [[ Enforce Body Processor URLENCODED ]] -----------------------------------
+#
+# ModSecurity selects the body processor based on the Content-Type request
+# header. But clients are not always setting the Content-Type header for their
+# request body payloads. This will leave ModSecurity with limited vision into
+# the payload.  The variable tx.enforce_bodyproc_urlencoded lets you force the
+# URLENCODED body processor in these situations. This is off by default, as it
+# implies a change of the behaviour of ModSecurity beyond CRS (the body
+# processor applies to all rules, not only CRS) and because it may lead to
+# false positives already on paranoia level 1. However, enabling this variable
+# closes a possible bypass of CRS so it should be considered.
+#
+# Uncomment this rule to change the default:
+#
+#SecAction \
+#    "id:900010,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.enforce_bodyproc_urlencoded=1"
+
+
+#
+# -- [[ Anomaly Scoring Mode Severity Levels ]] --------------------------------
+#
+# Each rule in the CRS has an associated severity level.
+# These are the default scoring points for each severity level.
+# These settings will be used to increment the anomaly score if a rule matches.
+# You may adjust these points to your liking, but this is usually not needed.
+#
+# - CRITICAL severity: Anomaly Score of 5.
+#       Mostly generated by the application attack rules (93x and 94x files).
+# - ERROR severity: Anomaly Score of 4.
+#       Generated mostly from outbound leakage rules (95x files).
+# - WARNING severity: Anomaly Score of 3.
+#       Generated mostly by malicious client rules (91x files).
+# - NOTICE severity: Anomaly Score of 2.
+#       Generated mostly by the protocol rules (92x files).
+#
+# In anomaly mode, these scores are cumulative.
+# So it's possible for a request to hit multiple rules.
+#
+# (Note: In this file, we use 'phase:1' to set CRS configuration variables.
+# In general, 'phase:request' is used. However, we want to make absolutely sure
+# that all configuration variables are set before the CRS rules are processed.)
+#
+#SecAction \
+#    "id:900100,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.critical_anomaly_score=5,\
+#    setvar:tx.error_anomaly_score=4,\
+#    setvar:tx.warning_anomaly_score=3,\
+#    setvar:tx.notice_anomaly_score=2"
+
+
+#
+# -- [[ Anomaly Scoring Mode Blocking Threshold Levels ]] ----------------------
+#
+# Here, you can specify at which cumulative anomaly score an inbound request,
+# or outbound response, gets blocked.
+#
+# Most detected inbound threats will give a critical score of 5.
+# Smaller violations, like violations of protocol/standards, carry lower scores.
+#
+# [ At default value ]
+# If you keep the blocking thresholds at the defaults, the CRS will work
+# similarly to previous CRS versions: a single critical rule match will cause
+# the request to be blocked and logged.
+#
+# [ Using higher values ]
+# If you want to make the CRS less sensitive, you can increase the blocking
+# thresholds, for instance to 7 (which would require multiple rule matches
+# before blocking) or 10 (which would require at least two critical alerts - or
+# a combination of many lesser alerts), or even higher. However, increasing the
+# thresholds might cause some attacks to bypass the CRS rules or your policies.
+#
+# [ New deployment strategy: Starting high and decreasing ]
+# It is a common practice to start a fresh CRS installation with elevated
+# anomaly scoring thresholds (>100) and then lower the limits as your
+# confidence in the setup grows. You may also look into the Sampling
+# Percentage section below for a different strategy to ease into a new
+# CRS installation.
+#
+# [ Anomaly Threshold / Paranoia Level Quadrant ]
+#
+#     High Anomaly Limit   |   High Anomaly Limit
+#     Low Paranoia Level   |   High Paranoia Level
+#     -> Fresh Site        |   -> Experimental Site
+# ------------------------------------------------------
+#     Low Anomaly Limit    |   Low Anomaly Limit
+#     Low Paranoia Level   |   High Paranoia Level
+#     -> Standard Site     |   -> High Security Site
+#
+# Uncomment this rule to change the defaults:
+#
+#SecAction \
+#    "id:900110,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.inbound_anomaly_score_threshold=5,\
+#    setvar:tx.outbound_anomaly_score_threshold=4"
+
+
+#
+# -- [[ Application Specific Rule Exclusions ]] --------------------------------
+#
+# CRS 3.x contained exclusion packages to tweak the CRS for use with common
+# web applications, lowering the number of false positives.
+#
+# In CRS 4, these are no longer part of the CRS itself, but they are available
+# as "CRS plugins". Some plugins improve support for web applications, and others
+# may bring new functionality. Plugins are not installed by default, but can be
+# downloaded from the plugin registry:
+# https://github.com/coreruleset/plugin-registry
+#
+# For detailed information about using and installing plugins, please see:
+# https://coreruleset.org/docs/concepts/plugins/
+
+
+#
+# -- [[ Anomaly Score Reporting Level ]] ---------------------------------------
+#
+# When a request is blocked due to the anomaly score meeting or exceeding the
+# anomaly threshold then the blocking rule will also report the anomaly score.
+# This applies to the separate inbound and outbound anomaly scores.
+#
+# In phase 5, there are additional rules that can perform additional reporting
+# of anomaly scores with a verbosity that depends on the reporting level defined
+# below.
+#
+# By setting the reporting level you control whether you want additional
+# reporting beyond the blocking rule or not and, if yes, which requests should
+# be covered. The higher the reporting level, the more verbose the reporting is.
+#
+# There are 6 reporting levels:
+#
+# 0 - Reporting disabled
+# 1 - Reporting for requests with a blocking anomaly score >= a threshold
+# 2 - Reporting for requests with a detection anomaly score >= a threshold
+# 3 - Reporting for requests with a blocking anomaly score greater than 0
+# 4 - Reporting for requests with a detection anomaly score greater than 0
+# 5 - Reporting for all requests
+#
+# Note: Reporting levels 1 and 2 make it possible to differentiate between
+# requests that are blocked and requests that are *not* blocked but would have
+# been blocked if the blocking PL was equal to detection PL. This may be useful
+# for certain FP tuning methodologies, for example moving to a higher PL.
+#
+# A value of 5 can be useful on platforms where you are interested in logging
+# non-scoring requests, yet it is not possible to report this information in
+# the request/access log. This applies to Nginx, for example.
+#
+#SecAction \
+#    "id:900115,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.reporting_level=4"
+
+
+#
+# -- [[ Early Anomaly Scoring Mode Blocking ]] ------------------------------
+#
+# The anomaly scores for the request and the responses are generally summed up
+# and evaluated at the end of phase:2 and at the end of phase:4 respectively.
+# However, it is possible to enable an early evaluation of these anomaly scores
+# at the end of phase:1 and at the end of phase:3.
+#
+# If a request (or a response) hits the anomaly threshold in this early
+# evaluation, then blocking happens immediately (if blocking is enabled) and
+# the phase 2 (and phase 4 respectively) will no longer be executed.
+#
+# Enable the rule 900120 that sets the variable tx.early_blocking to 1 in order
+# to enable early blocking. The variable tx.early_blocking is set to 0 by
+# default. Early blocking is thus disabled by default.
+#
+# Please note that early blocking will hide potential alerts from you. This
+# means that a payload that would appear in an alert in phase 2 (or phase 4)
+# does not get evaluated if the request is being blocked early. So when you
+# disabled early blocking again at some point in the future, then new alerts
+# from phase 2 might pop up.
+SecAction \
+    "id:900120,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:tx.early_blocking=1"
+
+
+#
+# -- [[ HTTP Policy Settings ]] ------------------------------------------------
+#
+# This section defines your policies for the HTTP protocol, such as:
+# - allowed HTTP versions, HTTP methods, allowed request Content-Types
+# - forbidden file extensions (e.g. .bak, .sql) and request headers (e.g. Proxy)
+#
+# These variables are used in the following rule files:
+# - REQUEST-911-METHOD-ENFORCEMENT.conf
+# - REQUEST-920-PROTOCOL-ENFORCEMENT.conf
+
+# HTTP methods that a client is allowed to use.
+# Default: GET HEAD POST OPTIONS
+# Example: for RESTful APIs, add the following methods: PUT PATCH DELETE
+# Example: for WebDAV, add the following methods: CHECKOUT COPY DELETE LOCK
+#          MERGE MKACTIVITY MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900200,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
+
+# Content-Types that a client is allowed to send in a request.
+# Default: |application/x-www-form-urlencoded| |multipart/form-data| |multipart/related|
+# |text/xml| |application/xml| |application/soap+xml| |application/json|
+# |application/cloudevents+json| |application/cloudevents-batch+json|
+#
+# Please note, that the rule where CRS uses this variable (920420) evaluates it with operator
+# `@within`, which is case sensitive, but uses t:lowercase. You must add your whole custom
+# Content-Type with lowercase.
+#
+# Bypass Warning: some applications may not rely on the content-type request header in order
+# to parse the request body. This could make an attacker able to send malicious URLENCODED/JSON/XML
+# payloads without being detected by the WAF. Allowing request content-type that doesn't activate any
+# body processor (for example: "text/plain", "application/x-amf", "application/octet-stream", etc..)
+# could lead to a WAF bypass. For example, a malicious JSON payload submitted with a "text/plain"
+# content type may still be interpreted as JSON by a backend application but would not trigger the
+# JSON body parser at the WAF, leading to a bypass.
+#
+# To prevent blocking request with not allowed content-type by default, you can create an exclusion
+# rule that removes rule 920420. For example:
+#SecRule REQUEST_HEADERS:Content-Type "@rx ^text/plain" \
+#    "id:1234,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    ctl:ruleRemoveById=920420,\
+#    chain"
+#    SecRule REQUEST_URI "@rx ^/foo/bar" "t:none"
+#
+# Uncomment this rule to change the default.
+#
+#SecAction \
+#    "id:900220,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"
+
+# Allowed HTTP versions.
+# Default: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0
+# Example for legacy clients: HTTP/0.9 HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0
+# Note that some web server versions use 'HTTP/2', some 'HTTP/2.0', so
+# we include both version strings by default.
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900230,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0'"
+
+# Forbidden file extensions.
+# Guards against unintended exposure of development/configuration files.
+# Default: .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/
+# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .rdb/ .sql/
+# Note that .axd was removed due to false positives (see PR 1925).
+#
+# To additionally guard against configuration/install archive files from being
+# accidentally exposed, common archive file extensions can be added to the
+# restricted extensions list. An example list of common archive file extensions
+# is presented below:
+# .7z/ .br/ .bz/ .bz2/ .cab/ .cpio/ .gz/ .img/ .iso/ .jar/ .rar/ .tar/ .tbz2/ .tgz/ .txz/ .xz/ .zip/ .zst/
+# (Source: https://en.wikipedia.org/wiki/List_of_archive_formats)
+#
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900240,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
+
+# Forbidden request headers.
+# Header names should be lowercase, enclosed by /slashes/ as delimiters.
+# Default: /accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/
+#
+# Note: Accept-Charset is a deprecated header that should not be used by clients and
+# ignored by servers. It can be used for a response WAF bypass, by asking for a charset
+# that the WAF cannot decode.
+# Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset
+#
+# Note: Content-Encoding is used to list any encodings that have been applied to the
+# original payload. It is only used for compression, which isn't supported by CRS by
+# default since it blocks newlines and null bytes inside the request body. Most
+# compression algorithms require at least null bytes per RFC. Blocking it shouldn't
+# break anything and increases security since ModSecurity is incapable of properly
+# scanning compressed request bodies.
+#
+# Note: Blocking Proxy header prevents 'httpoxy' vulnerability: https://httpoxy.org
+#
+# Note: Blocking the x-http-method-override,x-http-method and x-method-override headers
+# prevents attacks as described here: https://www.sidechannel.blog/en/http-method-override-what-it-is-and-how-a-pentester-can-use-it
+#
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900250,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.restricted_headers=/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
+
+# Content-Types charsets that a client is allowed to send in a request.
+# The content-types are enclosed by |pipes| as delimiters to guarantee exact matches.
+# Default: |utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|
+# Uncomment this rule to change the default.
+#SecAction \
+#    "id:900280,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"
+
+#
+# -- [[ HTTP Argument/Upload Limits ]] -----------------------------------------
+#
+# Here you can define optional limits on HTTP get/post parameters and uploads.
+# This can help to prevent application specific DoS attacks.
+#
+# These values are checked in REQUEST-920-PROTOCOL-ENFORCEMENT.conf.
+# Beware of blocking legitimate traffic when enabling these limits.
+#
+
+# Block request if number of arguments is too high
+# Default: unlimited
+# Example: 255
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900300,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.max_num_args=255"
+
+# Block request if the length of any argument name is too high
+# Default: unlimited
+# Example: 100
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900310,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.arg_name_length=100"
+
+# Block request if the length of any argument value is too high
+# Default: unlimited
+# Example: 400
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900320,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.arg_length=400"
+
+# Block request if the total length of all combined arguments is too high
+# Default: unlimited
+# Example: 64000
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900330,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.total_arg_length=64000"
+
+# Block request if the file size of any individual uploaded file is too high
+# Default: unlimited
+# Example: 1048576
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900340,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.max_file_size=1048576"
+
+# Block request if the total size of all combined uploaded files is too high
+# Default: unlimited
+# Example: 1048576
+# Uncomment this rule to set a limit.
+#SecAction \
+#    "id:900350,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.combined_file_sizes=1048576"
+
+
+#
+# -- [[ Easing In / Sampling Percentage ]] -------------------------------------
+#
+# Adding the Core Rule Set to an existing productive site can lead to false
+# positives, unexpected performance issues and other undesired side effects.
+#
+# It can be beneficial to test the water first by enabling the CRS for a
+# limited number of requests only and then, when you have solved the issues (if
+# any) and you have confidence in the setup, to raise the ratio of requests
+# being sent into the ruleset.
+#
+# Adjust the percentage of requests that are funnelled into the Core Rules by
+# setting TX.sampling_percentage below. The default is 100, meaning that every
+# request gets checked by the CRS.  The selection of requests, which are going
+# to be checked, is based on a pseudo random number generated by ModSecurity.
+#
+# If a request is allowed to pass without being checked by the CRS, there is no
+# entry in the audit log (for performance reasons), but an error log entry is
+# written.  If you want to disable the error log entry, then issue the
+# following directive somewhere after the inclusion of the CRS
+# (E.g., RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf).
+#
+#SecRuleUpdateActionById 901450 "nolog"
+#
+# ATTENTION: If this TX.sampling_percentage is below 100, then some of the
+# requests will bypass the Core Rules completely and you lose the ability to
+# protect your service with ModSecurity.
+#
+# Uncomment this rule to enable this feature:
+#
+#SecAction \
+#    "id:900400,\
+#    phase:1,\
+#    pass,\
+#    nolog,\
+#    setvar:tx.sampling_percentage=100"
+
+
+
+#
+# -- [[ Check UTF-8 encoding ]] ------------------------------------------------
+#
+# The CRS can optionally check request contents for invalid UTF-8 encoding.
+# We only want to apply this check if UTF-8 encoding is actually used by the
+# site; otherwise it will result in false positives.
+#
+# Uncomment this rule to use this feature:
+#
+#SecAction \
+#    "id:900950,\
+#    phase:1,\
+#    pass,\
+#    t:none,\
+#    nolog,\
+#    setvar:tx.crs_validate_utf8_encoding=1"
+
+
+#
+# -- [[ Collection timeout ]] --------------------------------------------------
+#
+# Set the SecCollectionTimeout directive from the ModSecurity default (1 hour)
+# to a lower setting which is appropriate to most sites.
+# This increases performance by cleaning out stale collection (block) entries.
+#
+# This value should be greater than or equal to any block durations or timeouts
+# set by plugins that make use of ModSecurity's persistent collections (e.g. the
+# DoS protection and IP reputation plugins).
+#
+# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecCollectionTimeout
+
+# Please keep this directive uncommented.
+# Default: 600 (10 minutes)
+SecCollectionTimeout 600
+
+
+#
+# -- [[ End of setup ]] --------------------------------------------------------
+#
+# The CRS checks the tx.crs_setup_version variable to ensure that the setup
+# has been loaded. If you are not planning to use this setup template,
+# you must manually set the tx.crs_setup_version variable before including
+# the CRS rules/* files.
+#
+# The variable is a numerical representation of the CRS version number.
+# E.g., v3.0.0 is represented as 300.
+#
+SecAction \
+    "id:900990,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:tx.crs_setup_version=400"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example

@@ -0,0 +1,200 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# The purpose of this file is to hold LOCAL exceptions for your site.  The
+# types of rules that would go into this file are one where you want to
+# short-circuit inspection and allow certain transactions to pass through
+# inspection or if you want to alter rules that are applied.
+#
+# This file is named REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example for a
+# very specific reason. Files affixed with the .example extension are designed
+# to contain user created/modified data. The '.example'. extension should be
+# renamed to end in .conf. The advantage of this is that when OWASP CRS is
+# updated, the updates will not overwrite a user generated configuration file.
+#
+# As a result of this design paradigm users are encouraged NOT to directly
+# modify rules. Instead they should use this
+# REQUEST-900-EXCLUSION-RULES-BEFORE-CRS and the
+# RESPONSE-999-EXCLUSION-RULES-AFTER-CRS file to modify OWASP rules using
+# methods similar to the examples specified below.
+#
+# REQUEST-900-EXCLUSION-RULES-BEFORE-CRS and
+# RESPONSE-999-EXCLUSION-RULES-AFTER-CRS serve different purposes. ModSecurity
+# effectively maintains two different context: startup, and per transaction.
+# As a rule, directives are processed within the startup context. While they
+# can affect the per transaction context they generally remain fixed during the
+# execution of ModSecurity.
+#
+# As a result if one wanted to disable a rule at bootup the SecRuleRemoveById
+# directive or one of its siblings would have to be placed AFTER the rule is
+# listed, otherwise it will not have knowledge of the rules existence (since
+# these rules are read in at the same time). This means that when using
+# directives that effect SecRules, these exceptions should be placed AFTER all
+# the existing rules. This is why RESPONSE-999-EXCLUSION-RULES-AFTER-CRS is
+# designed such that it loads LAST.
+#
+# Conversely, ModSecurity supports several actions that can change the state of
+# the underlying configuration during the per transaction context, this is when
+# rules are being processed. Generally, these are accomplished by using the
+# 'ctl' action. As these are part of a rule, they will be evaluated in the
+# order rules are applied (by physical location, considering phases). As a
+# result of this ordering a 'ctl' action should be placed with consideration to
+# when it will be executed. This is particularly relevant for the 'ctl' options
+# that involve modifying ID's (such as ruleRemoveById). In these cases it is
+# important that such rules are placed BEFORE the rule ID they will affect.
+# Unlike the setup context, by the time we process rules in the per-transaction
+# context, we are already aware of all the rule ID's. It is by this logic that
+# we include rules such as this BEFORE all the remaining rules.  As a result
+# REQUEST-900-EXCLUSION-RULES-BEFORE-CRS is designed to load FIRST.
+#
+# As a general rule:
+# ctl:ruleEngine            -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+# ctl:ruleRemoveById        -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+# ctl:ruleRemoveByMsg       -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+# ctl:ruleRemoveByTag       -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+# ctl:ruleRemoveTargetById  -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+# ctl:ruleRemoveTargetByMsg -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+# ctl:ruleRemoveTargetByTag -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
+#
+# SecRuleRemoveById         -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+# SecRuleRemoveByMsg        -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+# SecRuleRemoveByTag        -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+# SecRuleUpdateActionById   -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+# SecRuleUpdateTargetById   -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+# SecRuleUpdateTargetByMsg  -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+# SecRuleUpdateTargetByTag  -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
+#
+#
+# What follows are a group of examples that show you how to perform rule
+# exclusions.
+#
+#
+# Example Exclusion Rule: Disable inspection for an authorized client
+#
+# This ruleset allows you to control how ModSecurity will handle traffic
+# originating from Authorized Vulnerability Scanning (AVS) sources.  See
+# related blog post -
+# https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/updated-advanced-topic-of-the-week-handling-authorized-scanning-traffic/
+#
+# Allow List ASV network block (no blocking or logging of AVS traffic) Update
+# IP network block as appropriate for your AVS traffic
+#
+# ModSec Rule Exclusion: Disable Rule Engine for known ASV IP
+# SecRule REMOTE_ADDR "@ipMatch 192.168.1.100" \
+#     "id:1000,\
+#     phase:1,\
+#     pass,\
+#     nolog,\
+#     ctl:ruleEngine=Off"
+#
+#
+# Example Exclusion Rule: Removing a specific ARGS parameter from inspection
+#                         for an individual rule
+#
+# This rule shows how to conditionally exclude the "password"
+# parameter for rule 942100 when the REQUEST_URI is /index.php
+# ModSecurity Rule Exclusion: 942100 SQL Injection Detected via libinjection
+#
+# SecRule REQUEST_URI "@beginsWith /index.php" \
+#     "id:1001,\
+#     phase:1,\
+#     pass,\
+#     nolog,\
+#     ctl:ruleRemoveTargetById=942100;ARGS:password"
+#
+#
+# Example Exclusion Rule: Removing a specific ARGS parameter from inspection
+#                         for only certain attacks
+#
+# Attack rules within the CRS are tagged, with tags such as 'attack-lfi',
+# 'attack-sqli', 'attack-xss', 'attack-injection-php', et cetera.
+#
+# ModSecurity Rule Exclusion: Disable inspection of ARGS:pwd
+#                             for all rules tagged attack-sqli
+# SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
+#     "id:1002,\
+#     phase:2,\
+#     pass,\
+#     nolog,\
+#     ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:pwd"
+#
+
+# Example Exclusion Rule: Removing a specific ARGS parameter from inspection
+#                         for all CRS rules
+#
+# This rule illustrates that we can use tagging very effectively to allow list a
+# common false positive across an entire ModSecurity instance. This can be done
+# because every rule in OWASP_CRS is tagged with OWASP_CRS. This will NOT
+# affect custom rules.
+#
+# ModSecurity Rule Exclusion: Disable inspection of ARGS:pwd
+#                             for all CRS rules
+# SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
+#     "id:1003,\
+#     phase:2,\
+#     pass,\
+#     nolog,\
+#     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd"
+
+#
+# Example Exclusion Rule: Removing a range of rules
+#
+# This rule illustrates that we can remove a rule range via a ctl action.
+# This uses the fact, that rules are grouped by topic in rule files covering
+# a certain id range.
+#
+# ModSecurity Rule Exclusion: Disable all SQLi and XSS rules
+# SecRule REQUEST_FILENAME "@beginsWith /admin" \
+#     "id:1004,\
+#     phase:2,\
+#     pass,\
+#     nolog,\
+#     ctl:ruleRemoveById=941000-942999"
+#
+#
+# The application-specific rule exclusion plugins
+# (see: https://github.com/coreruleset/plugin-registry)
+# provide additional examples which can be useful then tuning a service.
+
+
+#
+# Example Rule: Allow monitoring tools and scripts
+#
+# Uncomment this rule to allow all requests from trusted IPs and User-Agent.
+# This can be useful for monitoring tools like Monit, Nagios, or other agents.
+# For example, if you're using AWS Load Balancer, you may need to trust all
+# requests from "10.0.0.0/8" subnet that come with the user-agent
+# "ELB-HealthChecker/2.0". By doing this, all requests that match these
+# conditions will not be matched against the following rules:
+#
+# - id: 911100 (allowed methods)
+# - id: 913100,913110,913120,913101,913102 (scan detection)
+# - id: 920280 (missing/empty host header)
+# - id: 920350 (IP address in host header)
+# - tag: attack-disclosure (all RESPONSE-*-DATA-LEAKAGES rules)
+#
+# SecRule REMOTE_ADDR "@ipMatch 10.0.0.0/8" \
+#    "id:1005,\
+#    phase:1,\
+#    pass,\
+#    nolog,\
+#    chain"
+#    SecRule REQUEST_METHOD "@pm GET HEAD" "chain"
+#       SecRule REQUEST_HEADERS:User-Agent "@pm ELB-HealthChecker" \
+#           "ctl:ruleRemoveById=911100,\
+#           ctl:ruleRemoveById=913100,\
+#           ctl:ruleRemoveById=913110,\
+#           ctl:ruleRemoveById=913120,\
+#           ctl:ruleRemoveById=913101,\
+#           ctl:ruleRemoveById=913102,\
+#           ctl:ruleRemoveById=920280,\
+#           ctl:ruleRemoveById=920350,\
+#           ctl:ruleRemoveByTag=attack-disclosure"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-901-INITIALIZATION.conf

@@ -0,0 +1,424 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# This file REQUEST-901-INITIALIZATION.conf initializes the Core Rules
+# and performs preparatory actions. It also fixes errors and omissions
+# of variable definitions in the file crs-setup.conf.
+# The crs-setup.conf can and should be edited by the user, this file
+# is part of the CRS installation and should not be altered.
+#
+
+
+#
+# -=[ Rules Version ]=-
+#
+# Rule version data is added to the "Producer" line of Section H of the Audit log:
+#
+# - Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.1.0.
+#
+# Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecComponentSignature
+#
+SecComponentSignature "OWASP_CRS/4.0.0-rc1"
+
+#
+# -=[ Default setup values ]=-
+#
+# The CRS checks the tx.crs_setup_version variable to ensure that the setup
+# file is included at the correct time. This detects situations where
+# necessary settings are not defined, for instance if the file
+# inclusion order is incorrect, or if the user has forgotten to
+# include the crs-setup.conf file.
+#
+# If you are upgrading from an earlier version of the CRS and you are
+# getting this error, please make a new copy of the setup template
+# crs-setup.conf.example to crs-setup.conf, and re-apply your policy
+# changes. There have been many changes in settings syntax from CRS2
+# to CRS3, so an old setup file may cause unwanted behavior.
+#
+# If you are not planning to use the crs-setup.conf template, you must
+# manually set the tx.crs_setup_version variable before including
+# the CRS rules/* files.
+#
+# The variable is a numerical representation of the CRS version number.
+# E.g., v3.0.0 is represented as 300.
+#
+
+SecRule &TX:crs_setup_version "@eq 0" \
+    "id:901001,\
+    phase:1,\
+    deny,\
+    status:500,\
+    log,\
+    auditlog,\
+    msg:'ModSecurity Core Rule Set is deployed without configuration! Please copy the crs-setup.conf.example template to crs-setup.conf, and include the crs-setup.conf file in your webserver configuration before including the CRS rules. See the INSTALL file in the CRS directory for detailed instructions',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL'"
+
+
+#
+# -=[ Default setup values ]=-
+#
+# Some constructs or individual rules will fail if certain parameters
+# are not set in the crs-setup.conf file. The following rules will catch
+# these cases and assign sane default values.
+#
+
+# Default Inbound Anomaly Threshold Level (rule 900110 in crs-setup.conf)
+SecRule &TX:inbound_anomaly_score_threshold "@eq 0" \
+    "id:901100,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.inbound_anomaly_score_threshold=5'"
+
+# Default Outbound Anomaly Threshold Level (rule 900110 in crs-setup.conf)
+SecRule &TX:outbound_anomaly_score_threshold "@eq 0" \
+    "id:901110,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.outbound_anomaly_score_threshold=4'"
+
+# Default Reporting Level (rule 900115 in crs-setup.conf)
+SecRule &TX:reporting_level "@eq 0" \
+    "id:901111,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.reporting_level=4'"
+
+# Default Early Blocking (rule 900120 in crs-setup.conf)
+SecRule &TX:early_blocking "@eq 0" \
+    "id:901115,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.early_blocking=0'"
+
+# Default Blocking Paranoia Level (rule 900000 in crs-setup.conf)
+SecRule &TX:blocking_paranoia_level "@eq 0" \
+    "id:901120,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.blocking_paranoia_level=1'"
+
+# Default Detection Paranoia Level (rule 900001 in crs-setup.conf)
+SecRule &TX:detection_paranoia_level "@eq 0" \
+    "id:901125,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.detection_paranoia_level=%{TX.blocking_paranoia_level}'"
+
+# Default Sampling Percentage (rule 900400 in crs-setup.conf)
+SecRule &TX:sampling_percentage "@eq 0" \
+    "id:901130,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.sampling_percentage=100'"
+
+# Default Anomaly Scores (rule 900100 in crs-setup.conf)
+SecRule &TX:critical_anomaly_score "@eq 0" \
+    "id:901140,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.critical_anomaly_score=5'"
+
+SecRule &TX:error_anomaly_score "@eq 0" \
+    "id:901141,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.error_anomaly_score=4'"
+
+SecRule &TX:warning_anomaly_score "@eq 0" \
+    "id:901142,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.warning_anomaly_score=3'"
+
+SecRule &TX:notice_anomaly_score "@eq 0" \
+    "id:901143,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.notice_anomaly_score=2'"
+
+# Default HTTP policy: allowed_methods (rule 900200 in crs-setup.conf)
+SecRule &TX:allowed_methods "@eq 0" \
+    "id:901160,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
+
+# Default HTTP policy: allowed_request_content_type (rule 900220 in crs-setup.conf)
+SecRule &TX:allowed_request_content_type "@eq 0" \
+    "id:901162,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"
+
+# Default HTTP policy: allowed_request_content_type_charset (rule 900280 in crs-setup.conf)
+SecRule &TX:allowed_request_content_type_charset "@eq 0" \
+    "id:901168,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"
+
+# Default HTTP policy: allowed_http_versions (rule 900230 in crs-setup.conf)
+SecRule &TX:allowed_http_versions "@eq 0" \
+    "id:901163,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0'"
+
+# Default HTTP policy: restricted_extensions (rule 900240 in crs-setup.conf)
+SecRule &TX:restricted_extensions "@eq 0" \
+    "id:901164,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
+
+# Default HTTP policy: restricted_headers (rule 900250 in crs-setup.conf)
+SecRule &TX:restricted_headers "@eq 0" \
+    "id:901165,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.restricted_headers=/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
+
+# Default enforcing of body processor URLENCODED (rule 900010 in crs-setup.conf)
+SecRule &TX:enforce_bodyproc_urlencoded "@eq 0" \
+    "id:901167,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.enforce_bodyproc_urlencoded=0'"
+
+# Default check for UTF8 encoding validation (rule 900950 in crs-setup.conf)
+SecRule &TX:crs_validate_utf8_encoding "@eq 0" \
+    "id:901169,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.crs_validate_utf8_encoding=0'"
+
+#
+# -=[ Initialize internal variables ]=-
+#
+
+# Initialize anomaly scoring variables.
+# All _score variables start at 0, and are incremented by the various rules
+# upon detection of a possible attack.
+
+SecAction \
+    "id:901200,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.blocking_inbound_anomaly_score=0',\
+    setvar:'tx.detection_inbound_anomaly_score=0',\
+    setvar:'tx.inbound_anomaly_score_pl1=0',\
+    setvar:'tx.inbound_anomaly_score_pl2=0',\
+    setvar:'tx.inbound_anomaly_score_pl3=0',\
+    setvar:'tx.inbound_anomaly_score_pl4=0',\
+    setvar:'tx.sql_injection_score=0',\
+    setvar:'tx.xss_score=0',\
+    setvar:'tx.rfi_score=0',\
+    setvar:'tx.lfi_score=0',\
+    setvar:'tx.rce_score=0',\
+    setvar:'tx.php_injection_score=0',\
+    setvar:'tx.http_violation_score=0',\
+    setvar:'tx.session_fixation_score=0',\
+    setvar:'tx.blocking_outbound_anomaly_score=0',\
+    setvar:'tx.detection_outbound_anomaly_score=0',\
+    setvar:'tx.outbound_anomaly_score_pl1=0',\
+    setvar:'tx.outbound_anomaly_score_pl2=0',\
+    setvar:'tx.outbound_anomaly_score_pl3=0',\
+    setvar:'tx.outbound_anomaly_score_pl4=0',\
+    setvar:'tx.anomaly_score=0'"
+
+
+#
+# -=[ Initialize collections ]=-
+#
+# Create both Global and IP collections for rules to use.
+# There are some CRS rules that assume that these two collections
+# have already been initiated.
+#
+
+SecRule REQUEST_HEADERS:User-Agent "@rx ^.*$" \
+    "id:901318,\
+    phase:1,\
+    pass,\
+    t:none,t:sha1,t:hexEncode,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'tx.ua_hash=%{MATCHED_VAR}'"
+
+SecAction \
+    "id:901321,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    initcol:global=global,\
+    initcol:ip=%{remote_addr}_%{tx.ua_hash}"
+
+#
+# -=[ Initialize Correct Body Processing ]=-
+#
+# Force request body variable and optionally request body processor
+#
+
+# Force body variable
+SecRule REQBODY_PROCESSOR "!@rx (?:URLENCODED|MULTIPART|XML|JSON)" \
+    "id:901340,\
+    phase:1,\
+    pass,\
+    nolog,\
+    noauditlog,\
+    msg:'Enabling body inspection',\
+    ctl:forceRequestBodyVariable=On,\
+    ver:'OWASP_CRS/4.0.0-rc1'"
+
+# Force body processor URLENCODED
+SecRule TX:enforce_bodyproc_urlencoded "@eq 1" \
+    "id:901350,\
+    phase:1,\
+    pass,\
+    t:none,t:urlDecodeUni,\
+    nolog,\
+    noauditlog,\
+    msg:'Enabling forced body inspection for ASCII content',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    chain"
+    SecRule REQBODY_PROCESSOR "!@rx (?:URLENCODED|MULTIPART|XML|JSON)" \
+        "ctl:requestBodyProcessor=URLENCODED"
+
+
+#
+# -=[ Easing In / Sampling Percentage ]=-
+#
+# This is used to send only a limited percentage of requests into the Core
+# Rule Set. The selection is based on TX.sampling_percentage and a pseudo
+# random number calculated below.
+#
+# Use this to ease into a new Core Rules installation with an existing
+# productive service.
+#
+# See
+# https://www.netnea.com/cms/2016/04/26/easing-in-conditional-modsecurity-rule-execution-based-on-pseudo-random-numbers/
+#
+
+#
+# Generate the pseudo random number
+#
+# ATTENTION: This is no cryptographically secure random number. It's just
+# a cheap way to get some random number suitable for sampling.
+#
+# We take the entropy contained in the UNIQUE_ID. We hash that variable and
+# take the first integer numbers out of it. Theoretically, it is possible
+# but highly improbable that there are no integers in a hexEncoded sha1 hash.
+# In the very rare event that two integers are not matched (due to only being
+# a-f in all, or all but one positions) 901450 will not be triggered.
+# Leading zeros are not removed from the two-digit random number, and are
+# handled gracefullly by 901450
+
+SecRule TX:sampling_percentage "@eq 100" \
+    "id:901400,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    skipAfter:END-SAMPLING"
+
+SecRule UNIQUE_ID "@rx ^[a-f]*([0-9])[a-f]*([0-9])" \
+    "id:901410,\
+    phase:1,\
+    pass,\
+    capture,\
+    t:sha1,t:hexEncode,\
+    nolog,\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'TX.sampling_rnd100=%{TX.1}%{TX.2}'"
+
+#
+# Sampling decision
+#
+# If a request is allowed to pass without being checked by the CRS, there is no
+# entry in the audit log (for performance reasons), but an error log entry is
+# being written.  If you want to disable the error log entry, then issue the
+# following directive somewhere after the inclusion of the CRS
+# (E.g., RESPONSE-999-EXCEPTIONS.conf).
+#
+# SecRuleUpdateActionById 901450 "nolog"
+#
+
+
+SecRule TX:sampling_rnd100 "!@lt %{tx.sampling_percentage}" \
+    "id:901450,\
+    phase:1,\
+    pass,\
+    log,\
+    noauditlog,\
+    msg:'Sampling: Disable the rule engine based on sampling_percentage %{TX.sampling_percentage} and random number %{TX.sampling_rnd100}',\
+    ctl:ruleRemoveByTag=OWASP_CRS,\
+    ver:'OWASP_CRS/4.0.0-rc1'"
+
+SecMarker "END-SAMPLING"
+
+
+#
+# Configuration Plausibility Checks
+#
+
+# Make sure detection paranoia level is not lower than paranoia level
+SecRule TX:detection_paranoia_level "@lt %{tx.blocking_paranoia_level}" \
+    "id:901500,\
+    phase:1,\
+    deny,\
+    status:500,\
+    t:none,\
+    log,\
+    msg:'Detection paranoia level configured is lower than the paranoia level itself. This is illegal. Blocking request. Aborting',\
+    ver:'OWASP_CRS/4.0.0-rc1'"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-905-COMMON-EXCEPTIONS.conf

@@ -0,0 +1,55 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+
+# This file is used as an exception mechanism to remove common false positives
+# that may be encountered.
+#
+# Exception for Apache SSL pinger
+#
+SecRule REQUEST_LINE "@streq GET /" \
+    "id:905100,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-apache',\
+    tag:'attack-generic',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    chain"
+    SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" \
+        "t:none,\
+        ctl:ruleRemoveByTag=OWASP_CRS,\
+        ctl:auditEngine=Off"
+
+#
+# Exception for Apache internal dummy connection
+#
+SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" \
+    "id:905110,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-apache',\
+    tag:'attack-generic',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    chain"
+    SecRule REQUEST_HEADERS:User-Agent "@endsWith (internal dummy connection)" \
+        "t:none,\
+        chain"
+        SecRule REQUEST_LINE "@rx ^(?:GET /|OPTIONS \*) HTTP/[12]\.[01]$" \
+            "t:none,\
+            ctl:ruleRemoveByTag=OWASP_CRS,\
+            ctl:auditEngine=Off"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-911-METHOD-ENFORCEMENT.conf

@@ -0,0 +1,76 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:911011,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:911012,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ Allowed Request Methods ]=-
+#
+# tx.allowed_methods is defined in the crs-setup.conf file
+#
+SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" \
+    "id:911100,\
+    phase:1,\
+    block,\
+    msg:'Method is not allowed by policy',\
+    logdata:'%{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-generic',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/274',\
+    tag:'PCI/12.1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:911013,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:911014,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:911015,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:911016,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:911017,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:911018,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-911-METHOD-ENFORCEMENT"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-913-SCANNER-DETECTION.conf

@@ -0,0 +1,189 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:913011,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:913012,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ Vulnerability Scanner Checks ]=-
+#
+# These rules inspect the default User-Agent and Header values sent by
+# various commercial and open source vuln scanners.
+#
+# The following rules contain User-Agent lists:
+# 913100 - security scanners (data file scanners-user-agents.data)
+# 913101 - scripting/generic HTTP clients (data file scripting-user-agents.data)
+# 913102 - web crawlers/bots (data file crawlers-user-agents.data)
+#
+# Chained rule is allow listing:
+# YUM package manager of CentOS / Fedore: User-Agent: urlgrabber/3.10 yum/3.4.3
+# eCairn service: User-Agent: mozilla/5.0 ecairn-grabber/1.0 (+http://ecairn.com/grabber)
+SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
+    "id:913100,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Found User-Agent associated with security scanner',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-reputation-scanner',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/224/541/310',\
+    tag:'PCI/6.5.10',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule MATCHED_VARS "!@rx ^(?:urlgrabber/[0-9\.]+ yum/[0-9\.]+|mozilla/[0-9\.]+ ecairn-grabber/[0-9\.]+ \(\+http://ecairn.com/grabber\))$" \
+        "setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" \
+    "id:913110,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Found request header associated with security scanner',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-reputation-scanner',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/224/541/310',\
+    tag:'PCI/6.5.10',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+SecRule REQUEST_FILENAME|ARGS "@pmFromFile scanners-urls.data" \
+    "id:913120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Found request filename/argument associated with security scanner',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-reputation-scanner',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/224/541/310',\
+    tag:'PCI/6.5.10',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:913013,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:913014,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+#
+# -=[ Scripting/Generic User-Agents ]=-
+#
+# This rule detects user-agents associated with various HTTP client libraries
+# and scripting languages. Detection suggests attempted access by some
+# automated tool.
+#
+# This rule is a sibling of rule 913100.
+#
+SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scripting-user-agents.data" \
+    "id:913101,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Found User-Agent associated with scripting/generic HTTP client',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-reputation-scripting',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/224/541/310',\
+    tag:'PCI/6.5.10',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+
+#
+# -=[ Crawler User-Agents ]=-
+#
+# This rule detects user-agents associated with various crawlers, SEO tools,
+# and bots, which have been reported to potentially misbehave.
+# These crawlers can have legitimate uses when used with authorization.
+#
+# This rule is a sibling of rule 913100.
+#
+SecRule REQUEST_HEADERS:User-Agent "@pmFromFile crawlers-user-agents.data" \
+    "id:913102,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Found User-Agent associated with web crawler/bot',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-reputation-crawler',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/150',\
+    tag:'PCI/6.5.10',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:913015,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:913016,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:913017,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:913018,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-913-SCANNER-DETECTION"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-921-PROTOCOL-ATTACK.conf

@@ -0,0 +1,560 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:921011,phase:1,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:921012,phase:2,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ HTTP Request Smuggling ]=-
+#
+# [ Rule Logic ]
+# This rule looks for a HTTP / WEBDAV method name in combination with the word http/\d or a CR/LF character.
+# This would point to an attempt to inject a 2nd request into the request, thus bypassing
+# tests carried out on the primary request.
+#
+# [ References ]
+# http://projects.webappsec.org/HTTP-Request-Smuggling
+#
+SecRule ARGS_NAMES|ARGS|REQUEST_BODY|XML:/* "@rx (?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\s+[^\s]+\s+http/\d" \
+    "id:921110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:htmlEntityDecode,t:lowercase,\
+    msg:'HTTP Request Smuggling Attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/33',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+#
+# -=[ HTTP Response Splitting ]=-
+#
+# [ Rule Logic ]
+# These rules look for Carriage Return (CR) %0d and Linefeed (LF) %0a characters.
+# These characters may cause problems if the data is returned in a response header and
+# may be interpreted by an intermediary proxy server and treated as two separate
+# responses.
+#
+# [ References ]
+# http://projects.webappsec.org/HTTP-Response-Splitting
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\r\n]\W*?(?:content-(?:type|length)|set-cookie|location):\s*\w" \
+    "id:921120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'HTTP Response Splitting Attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/34',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\bhttp/\d|<(?:html|meta)\b)" \
+    "id:921130,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:htmlEntityDecode,t:lowercase,\
+    msg:'HTTP Response Splitting Attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/34',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+#
+# -=[ HTTP Header Injection ]=-
+#
+# [ Rule Logic ]
+# These rules look for Carriage Return (CR) %0d and Linefeed (LF) %0a characters,
+# on their own or in combination with header field names.
+# These characters may cause problems if the data is returned in a response header
+# and interpreted by the client.
+# The rules are similar to rules defending against the HTTP Request Splitting and
+# Request Smuggling rules.
+#
+# [ References ]
+# https://en.wikipedia.org/wiki/HTTP_header_injection
+#
+SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@rx [\n\r]" \
+    "id:921140,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:htmlEntityDecode,\
+    msg:'HTTP Header Injection Attack via headers',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/273',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+# Detect newlines in argument names.
+# Checking for GET arguments has been moved to paranoia level 2 (921151)
+# in order to mitigate possible false positives.
+#
+# This rule is also triggered by the following exploit(s):
+# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
+#
+SecRule ARGS_NAMES "@rx [\n\r]" \
+    "id:921150,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:htmlEntityDecode,\
+    msg:'HTTP Header Injection Attack via payload (CR/LF detected)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/33',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule ARGS_GET_NAMES|ARGS_GET "@rx [\n\r]+(?:\s|location|refresh|(?:set-)?cookie|(?:x-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))\s*:" \
+    "id:921160,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:htmlEntityDecode,t:lowercase,\
+    msg:'HTTP Header Injection Attack via payload (CR/LF and header-name detected)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/33',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+# -=[ HTTP Splitting ]=-
+#
+# This rule detect \n or \r in the REQUEST FILENAME
+# Reference: https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)
+#
+SecRule REQUEST_FILENAME "@rx [\n\r]" \
+    "id:921190,\
+    phase:1,\
+    block,\
+    t:none,t:urlDecodeUni,\
+    msg:'HTTP Splitting (CR/LF in request filename detected)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/34',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# -=[ LDAP Injection ]=-
+#
+# [ Rule Logic ]
+#
+# This is a rule trying to prevent LDAP injection. It is based on a BlackHat presentation by Alonso Parada
+# and regex writing by Denis Kolegov.
+#
+# [ References ]
+# * https://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper/bh-eu-08-alonso-parada-WP.pdf
+# * https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
+# * https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/276#issue-126581660
+
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx ^[^:\(\)\&\|\!\<\>\~]*\)\s*(?:\((?:[^,\(\)\=\&\|\!\<\>\~]+[><~]?=|\s*[&!|]\s*(?:\)|\()?\s*)|\)\s*\(\s*[\&\|\!]\s*|[&!|]\s*\([^\(\)\=\&\|\!\<\>\~]+[><~]?=[^:\(\)\&\|\!\<\>\~]*)" \
+    "id:921200,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:htmlEntityDecode,\
+    msg:'LDAP Injection Attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-ldap',\
+    tag:'platform-multi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248/136',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+#
+# -=[ Body Processor Bypass ]=-
+#
+# [ Rule Logic ]
+#
+# This rule intends to detect content types in the Content-Type header outside of the actual content type declaration.
+# This prevents bypasses targeting the Modsecurity recommended rules controlling which body processor is used.
+#
+# Regular expression generated from regex-assembly/921421.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 921421
+#
+SecRule REQUEST_HEADERS:Content-Type "@rx ^[^\s\v,;]+[\s\v,;].*?(?:application/(?:.+\+)?json|(?:application/(?:soap\+)?|text/)xml)" \
+    "id:921421,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Content-Type header: Dangerous content type outside the mime type declaration',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153',\
+    tag:'PCI/12.1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# Rule against CVE-2021-40438:
+# A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
+# This issue affects Apache HTTP Server 2.4.48 and earlier.
+# GET /?unix:AAAAAAAAAAAAA|http://coreruleset.org/
+#
+SecRule REQUEST_URI "@rx unix:[^|]*\|" \
+    "id:921240,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'mod_proxy attack attempt detected',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-apache',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/33',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:921013,phase:1,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:921014,phase:2,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+# Detect newlines in GET argument values.
+# These may point to a HTTP header injection attack, but can also sometimes
+# occur in benign query parameters.
+#
+# See also: rule 921140, 921150
+#
+SecRule ARGS_GET "@rx [\n\r]" \
+    "id:921151,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,t:htmlEntityDecode,\
+    msg:'HTTP Header Injection Attack via payload (CR/LF detected)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220/33',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+#
+# -=[ Body Processor Bypass ]=-
+#
+# [ Rule Logic ]
+#
+# This rule intends to detect content types in the Content-Type header outside of the actual content type declaration.
+#
+# [ References ]
+# * See rule 921422
+#
+# Regular expression generated from regex-assembly/921422.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 921422
+#
+SecRule REQUEST_HEADERS:Content-Type "@rx ^[^\s\v,;]+[\s\v,;].*?\b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([\+/]))\b" \
+    "id:921422,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Content-Type header: Dangerous content type outside the mime type declaration',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153',\
+    tag:'PCI/12.1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:921015,phase:1,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:921016,phase:2,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+#
+
+# Forbid Request Range Header
+#
+# It is possible abuse the HTTP Request Range Header to leak error pages
+# and other information in very small snippets.
+# The easiest way to fight this is to deny the use of this header.
+# This is a viable option since the header is only used in rare circumstances
+# anymore.
+# If it is necessary to use it in a certain setup, then it is best to
+# create a rule exclusion for a given URI and this rule ID as a workaround.
+#
+SecRule &REQUEST_HEADERS:Range "@gt 0" \
+    "id:921230,\
+    phase:1,\
+    block,\
+    t:none,\
+    msg:'HTTP Range Header detected',\
+    logdata:'Matched Data: Header %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'paranoia-level/3',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/210/272/220',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+# -=[ HTTP Parameter Pollution ]=-
+#
+# [ Rule Logic ]
+# These rules look for multiple parameters with the same name.
+# 921170 counts the occurrences of the individual parameters.
+# 921180 checks if any counter is > 1.
+#
+# One HPP attack vector is to try evade signature filters by distributing the
+# attack payload across multiple parameters with the same name.
+# This works as many security devices only apply signatures to individual
+# parameter payloads, however the back-end web application may (in the case
+# of ASP.NET) consolidate all of the payloads into one thus making the
+# attack payload active.
+#
+# [ References ]
+# http://tacticalwebappsec.blogspot.com/2009/05/http-parameter-pollution.html
+# https://capec.mitre.org/data/definitions/460.html
+#
+SecRule ARGS_NAMES "@rx ." \
+    "id:921170,\
+    phase:2,\
+    pass,\
+    nolog,\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/15/460',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    setvar:'TX.paramcounter_%{MATCHED_VAR_NAME}=+1'"
+
+SecRule TX:/paramcounter_.*/ "@gt 1" \
+    "id:921180,\
+    phase:2,\
+    pass,\
+    msg:'HTTP Parameter Pollution (%{TX.1})',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/15/460',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule MATCHED_VARS_NAMES "@rx TX:paramcounter_(.*)" \
+        "capture,\
+        setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+# -=[ HTTP Parameter Pollution ]=-
+#
+# [ Rule Logic ]
+# Parameter pollution rule 921180 PL3 can by bypassed when a weak backend parameter
+# parser is ignoring additional characters in a parameter array name after the
+# closing of the array.
+# Rule 921210 PL3 prevents this by disallowing arbitrary strings after an array has
+# been closed or inbetween the square brackets in multidimensional arrays.
+# Please note that rule 921120 allows for 2-dimensional, but not for higher dimensional
+# arrays. If these are flagged as attacks, a rule exclusion will have to be
+# deployed; ideally for the parameter(s) in question.
+#
+# [ References ]
+# Private bug bounty in Spring 2022, findings Z05OZUCH.
+#
+# [ Payloads ]
+# * foo[1]a=bar&foo[1]b=<evil> - parameter parsers often cut after the closing of
+#   the array. 921180 PL3 takes the full name, though.
+#   This impediance mismatch allows for bypasses.
+# * foo[1]x[1]=bar&foo[1]x[2]=<evil> - extension of 1; this has the advantage that
+#   the parameter name does end with "]" just like a valid array notation.
+#
+SecRule ARGS_NAMES "@rx (][^\]]+$|][^\]]+\[)" \
+    "id:921210,\
+    phase:2,\
+    pass,\
+    log,\
+    msg:'HTTP Parameter Pollution after detecting bogus char after parameter array',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/15/460',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:921017,phase:1,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:921018,phase:2,pass,nolog,skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+# -=[ HTTP Parameter Pollution ]=-
+#
+# [ Rule Logic ]
+# Parameter pollution rule 921180 PL3 and 921210 PL3 can by bypassed if a
+# weak backend parameter parser ignores parameter array alltogether at
+# cuts parameter names at the first occurrence of the "[" character.
+# The rule 921220 PL4 prevents this by disallowing parameter array names.
+#
+# If an application needs parameter array names, then this rule should be
+# disabled, ideally by issueing a rule exclusion for the parameter names
+# that need it.
+#
+# [ References ]
+# Private bug bounty in Spring 2022, finding 5UXE4RK0.
+#
+# [ Payloads ]
+# * foo[1]=bar&foo[2]=<evil>
+# * foo=bar&foo[1]=<evil>
+# * foo[1]=bar&foo[1]acb]=<evil> - this is an edge case that 921210 PL3 is not
+#   able to catch since the parameter name ends with "]".
+#
+SecRule ARGS_NAMES "@rx \[" \
+    "id:921220,\
+    phase:2,\
+    pass,\
+    log,\
+    msg:'HTTP Parameter Pollution possible via array notation',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/15/460',\
+    tag:'paranoia-level/4',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-921-PROTOCOL-ATTACK"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-922-MULTIPART-ATTACK.conf

@@ -0,0 +1,92 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+# This file is to address the 3UWMWA6W vulnerability.
+# It requires ModSecurity version 2.9.6 or 3.0.8 (or an updated version with backports
+# of the security fixes in these versions) or a compatible engine supporting these changes.
+#
+# If you cannot upgrade ModSecurity, this file will cause ModSecurity to fail to start.
+# In that case, you can temporarily delete this file. However, you will be missing
+# protection from these rules. Therefore, we recommend upgrading your engine instead.
+
+# The rules in this file will be part of the 920 / 921 in the future.
+
+# Only allow specific charsets when using "_charset_"
+# Note: this is in phase:2 because these are headers that come in the body
+SecRule &MULTIPART_PART_HEADERS:_charset_ "!@eq 0" \
+    "id:922100,\
+    phase:2,\
+    block,\
+    t:none,\
+    msg:'Multipart content type global _charset_ definition is not allowed by policy',\
+    logdata:'Matched Data: %{ARGS._charset_}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-multipart-header',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule ARGS:_charset_ "!@within |%{tx.allowed_request_content_type_charset}|" \
+        "t:lowercase,\
+        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+# Only allow specific charsets same as Rule 920600
+# Note: this is in phase:2 because these are headers that come in the body
+SecRule MULTIPART_PART_HEADERS "@rx ^content-type\s*:\s*(.*)$" \
+    "id:922110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Illegal MIME Multipart Header content-type: charset parameter',\
+    logdata:'Matched Data: %{TX.1} found within Content-Type multipart form',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-protocol',\
+    tag:'OWASP_CRS',\
+    tag:'capec/272/220',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule TX:1 "!@rx ^(?:(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)/(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)|\*)(?:[\s\v]*;[\s\v]*(?:charset[\s\v]*=[\s\v]*\"?(?:iso-8859-15?|utf-8|windows-1252)\b\"?|(?:[^\s\v -\"\(-\),/:-\?\[-\]c\{\}]|c(?:[^!-\"\(-\),/:-\?\[-\]h\{\}]|h(?:[^!-\"\(-\),/:-\?\[-\]a\{\}]|a(?:[^!-\"\(-\),/:-\?\[-\]r\{\}]|r(?:[^!-\"\(-\),/:-\?\[-\]s\{\}]|s(?:[^!-\"\(-\),/:-\?\[-\]e\{\}]|e[^!-\"\(-\),/:-\?\[-\]t\{\}]))))))[^!-\"\(-\),/:-\?\[-\]\{\}]*[\s\v]*=[\s\v]*[^!\(-\),/:-\?\[-\]\{\}]+);?)*(?:[\s\v]*,[\s\v]*(?:(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)/(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)|\*)(?:[\s\v]*;[\s\v]*(?:charset[\s\v]*=[\s\v]*\"?(?:iso-8859-15?|utf-8|windows-1252)\b\"?|(?:[^\s\v -\"\(-\),/:-\?\[-\]c\{\}]|c(?:[^!-\"\(-\),/:-\?\[-\]h\{\}]|h(?:[^!-\"\(-\),/:-\?\[-\]a\{\}]|a(?:[^!-\"\(-\),/:-\?\[-\]r\{\}]|r(?:[^!-\"\(-\),/:-\?\[-\]s\{\}]|s(?:[^!-\"\(-\),/:-\?\[-\]e\{\}]|e[^!-\"\(-\),/:-\?\[-\]t\{\}]))))))[^!-\"\(-\),/:-\?\[-\]\{\}]*[\s\v]*=[\s\v]*[^!\(-\),/:-\?\[-\]\{\}]+);?)*)*$" \
+        "t:lowercase,\
+        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used (see: https://www.rfc-editor.org/rfc/rfc7578#section-4.7)
+# Note: this is in phase:2 because these are headers that come in the body
+SecRule MULTIPART_PART_HEADERS "@rx content-transfer-encoding:(.*)" \
+    "id:922120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used',\
+    logdata:'Matched Data: %{TX.0}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-deprecated-header',\
+    tag:'OWASP_CRS',\
+    tag:'capec/272/220',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-930-APPLICATION-ATTACK-LFI.conf

@@ -0,0 +1,203 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:930011,phase:1,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:930012,phase:2,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ Directory Traversal Attacks ]=-
+#
+# Ref: https://github.com/wireghoul/dotdotpwn
+#
+# [ Encoded /../ Payloads ]
+#
+# Regular expression generated from regex-assembly/930100.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 930100
+#
+SecRule REQUEST_URI_RAW|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/* "@rx (?i)(?:[/\x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))(?:\.(?:%0[0-1]|\?)?|\?\.?|%(?:2(?:(?:5(?:2|c0%25a))?e|%45)|c0(?:\.|%[25-6ae-f]e)|u(?:(?:ff0|002)e|2024)|%32(?:%(?:%6|4)5|E)|(?:e|f(?:(?:8|c%80)%8)?0%8)0%80%ae)|0x2e){2,3}(?:[/\x5c]|%(?:2(?:f|5(?:2f|5c|c(?:1%259c|0%25af))|%46)|5c|c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|(?:bg%q|(?:e|f(?:8%8)?0%8)0%80%a)f|u(?:221[5-6]|EFC8|F025|002f)|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|1u)|0x(?:2f|5c))" \
+    "id:930100,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Path Traversal Attack (/../) or (/.../)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-lfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153/126',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}'"
+
+#
+# [ Decoded /../ or /..;/ Payloads ]
+#
+# To prevent '..' from triggering, the regexp is split into two parts:
+# - ../
+# - /..
+# OR
+# - .../
+# - /...
+#
+# Semicolon added to prevent path traversal via reverse proxy mapping '/..;/' (Tomcat)
+#
+SecRule REQUEST_URI|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/* "@rx (?:(?:^|[\x5c/;])\.{2,3}[\x5c/;]|[\x5c/;]\.{2,3}(?:[\x5c/;]|$))" \
+    "id:930110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,\
+    msg:'Path Traversal Attack (/../) or (/.../)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-lfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153/126',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    multiMatch,\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}'"
+
+#
+# -=[ OS File Access ]=-
+#
+# We check for OS file access with the help of a local file with OS files data.
+#
+# Ref: https://github.com/lightos/Panoptic/blob/master/cases.xml
+#
+# If you wonder where support for Google OAuth2 has gone, see:
+# https://github.com/coreruleset/google-oauth2-plugin
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile lfi-os-files.data" \
+    "id:930120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\
+    msg:'OS File Access Attempt',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-lfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153/126',\
+    tag:'PCI/6.5.4',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+#
+# -=[ Restricted File Access ]=-
+#
+# Detects attempts to retrieve application source code, metadata,
+# credentials and version control history possibly reachable in a web root.
+#
+SecRule REQUEST_FILENAME "@pmFromFile restricted-files.data" \
+    "id:930130,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\
+    msg:'Restricted File Access Attempt',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-lfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153/126',\
+    tag:'PCI/6.5.4',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:930013,phase:1,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:930014,phase:2,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+#
+# -=[ OS File Access ]=-
+#
+# This is a stricter sibling of rule 930120.
+# This stricter sibling checks for OS file data in request headers referer and user-agent.
+# We check for OS file access with the help of a local file with OS files data.
+#
+# Ref: https://github.com/lightos/Panoptic/blob/master/cases.xml
+#
+SecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent "@pmFromFile lfi-os-files.data" \
+    "id:930121,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,\
+    msg:'OS File Access Attempt in REQUEST_HEADERS',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-lfi',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/255/153/126',\
+    tag:'PCI/6.5.4',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:930015,phase:1,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:930016,phase:2,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:930017,phase:1,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:930018,phase:2,pass,nolog,skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-930-APPLICATION-ATTACK-LFI"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-931-APPLICATION-ATTACK-RFI.conf

@@ -0,0 +1,189 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+#
+# RFI Attacks
+#
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:931011,phase:1,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:931012,phase:2,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+# -=[ Rule Logic ]=-
+# These rules look for common types of Remote File Inclusion (RFI) attack methods.
+#	- URL Contains an IP Address
+#	- The PHP "include()" Function
+#	- RFI Data Ends with Question Mark(s) (?)
+#	- RFI Host Doesn't Match Local Host
+#
+# -=[ References ]=-
+# http://projects.webappsec.org/Remote-File-Inclusion
+# http://tacticalwebappsec.blogspot.com/2009/06/generic-remote-file-inclusion-attack.html
+#
+SecRule ARGS "@rx ^(?i:file|ftps?|https?)://(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" \
+    "id:931100,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-rfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/175/253',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+SecRule QUERY_STRING|REQUEST_BODY "@rx (?i)(?:\binclude\s*\([^)]*|mosConfig_absolute_path|_CONF\[path\]|_SERVER\[DOCUMENT_ROOT\]|GALLERY_BASEDIR|path\[docroot\]|appserv_root|config\[root_dir\])=(?:file|ftps?|https?)://" \
+    "id:931110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,\
+    msg:'Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-rfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/175/253',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+SecRule ARGS "@rx ^(?i:file|ftps?|https?).*?\?+$" \
+    "id:931120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-rfi',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/175/253',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:931013,phase:1,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:931014,phase:2,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+# url:file:// can be used by Java applications using
+# org.apache.commons.io.IOUtils to access internal files, so this has been added
+#
+# This rule has one (stricter) sibling: 931131.
+# That rule applies the same regular expression to the request filename in phase 1.
+#
+# Regular expression generated from regex-assembly/931130.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 931130
+#
+SecRule ARGS "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" \
+    "id:931130,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-rfi',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/175/253',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rfi_parameter_%{MATCHED_VAR_NAME}=.%{tx.1}',\
+    chain"
+    SecRule TX:/rfi_parameter_.*/ "!@endsWith .%{request_headers.host}" \
+        "setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+# This is a (stricter) sibling of 931130.
+#
+# Regular expression generated from regex-assembly/931131.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 931131
+#
+SecRule REQUEST_FILENAME "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[^@]+@)?([^/]*)" \
+    "id:931131,\
+    phase:1,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,\
+    msg:'Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-rfi',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/175/253',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rfi_parameter_%{MATCHED_VAR_NAME}=.%{tx.1}',\
+    chain"
+    SecRule TX:/rfi_parameter_.*/ "!@endsWith .%{request_headers.host}" \
+        "setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:931015,phase:1,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:931016,phase:2,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:931017,phase:1,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:931018,phase:2,pass,nolog,skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-931-APPLICATION-ATTACK-RFI"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf

@@ -0,0 +1,768 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:933011,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:933012,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ PHP Injection Attacks ]=-
+#
+# [ References ]
+# http://rips-scanner.sourceforge.net/
+# https://www.owasp.org/index.php/PHP_Top_5#P1:_Remote_Code_Executionh
+#
+
+#
+# [ PHP Open Tag Found ]
+#
+# Detects PHP open tags "<?" and "<?php".
+# http://www.php.net/manual/en/language.basic-syntax.phptags.php
+#
+# Care is taken to avoid false positives in XML declarations "<?xml..."
+#
+# Also detects "[php]", "[/php]" and "[\php]" tags used by some applications
+# to indicate PHP dynamic content.
+#
+# Previously, this rule also checked for the PHP close tag '?>', but
+# this resulted in false positives which were difficult to prevent.
+# Therefore, that pattern is now checked by rule 933190 in paranoia levels
+# 3 or higher.
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:<\?(?:[^x]|x[^m]|xm[^l]|xml[^\s]|xml$|$)|<\?php|\[(?:/|\x5c)?php\])" \
+    "id:933100,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'PHP Injection Attack: PHP Open Tag Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+#
+# [ PHP Script Uploads ]
+#
+# Block file uploads with filenames ending in PHP related extensions
+# (.php, .phps, .phtml, .php5 etc).
+#
+# Many application contain Unrestricted File Upload vulnerabilities.
+# https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
+#
+# Attackers may use such a vulnerability to achieve remote code execution
+# by uploading a .php file. If the upload storage location is predictable
+# and not adequately protected, the attacker may then request the uploaded
+# .php file and have the code within it executed on the server.
+#
+# Also block files with just dot (.) characters after the extension:
+# https://community.rapid7.com/community/metasploit/blog/2013/08/15/time-to-patch-joomla
+#
+# Some AJAX uploaders use the nonstandard request headers X-Filename,
+# X_Filename, or X-File-Name to transmit the file name to the server;
+# scan these request headers as well as multipart/form-data file names.
+#
+SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.ph(?:p\d*|tml|ar|ps|t|pt)\.*$" \
+    "id:933110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'PHP Injection Attack: PHP Script File Upload Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Configuration Directives ]
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-config-directives.data" \
+    "id:933120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:normalisePath,\
+    msg:'PHP Injection Attack: Configuration Directive Found',\
+    logdata:'Matched Data: %{TX.933120_TX_0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.933120_tx_0=%{tx.0}',\
+    chain"
+    SecRule MATCHED_VARS "@pm =" \
+        "capture,\
+        setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Variables ]
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-variables.data" \
+    "id:933130,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:normalisePath,t:urlDecodeUni,\
+    msg:'PHP Injection Attack: Variables Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP I/O Streams ]
+#
+# The "php://" syntax can be used to refer to various objects, such as local files (for LFI),
+# remote urls (for RFI), or standard input/request body. Its occurrence indicates a possible attempt
+# to either inject PHP code or exploit a file inclusion vulnerability in a PHP web app.
+#
+# Examples:
+# php://filter/resource=./../../../wp-config.php
+# php://filter/resource=http://www.example.com
+# php://stdin
+# php://input
+#
+# http://php.net/manual/en/wrappers.php.php
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" \
+    "id:933140,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: I/O Stream Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Wrappers ]
+#
+# PHP comes with many built-in wrappers for various URL-style protocols for use with the filesystem
+# functions such as fopen(), copy(), file_exists() and filesize(). Abusing of PHP wrappers like phar://
+# could lead to RCE as describled by Sam Thomas at BlackHat USA 2018 (https://bit.ly/2yaKV5X), even
+# wrappers like zlib://, glob://, rar://, zip://, etc... could lead to LFI and expect:// to RCE.
+#
+# Valid PHP wrappers can be found in the PHP documentation here:
+# https://www.php.net/manual/en/wrappers.php
+#
+# Regular expression generated from regex-assembly/933200.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 933200
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://" \
+    "id:933200,\
+    phase:2,\
+    block,\
+    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,\
+    msg:'PHP Injection Attack: Wrapper scheme detected',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Functions ]
+#
+# Detecting PHP function names is useful to block PHP code injection attacks.
+# There are many PHP functions. We have to strike a balance between robust detection
+# of PHP code in content, and the risk of false positives.
+#
+# The list of PHP functions is divided into four groups of varying attack/false positive risk.
+# Four separate rules are used to detect these groups of functions:
+#
+# - Rule 933150: ~40 words highly common to PHP injection payloads and extremely rare in
+#		natural language or other contexts.
+#		Examples: 'base64_decode', 'file_get_contents'.
+#		These words are detected as a match directly using @pmFromFile.
+#		Function names are defined in php-function-names-933150.data
+#
+# - Rule 933160: ~220 words which are common in PHP code, but have a higher chance to cause
+#		false positives in natural language or other contexts.
+#		Examples: 'chr', 'eval'.
+#		To mitigate false positives, a regexp looks for PHP function syntax, e.g. 'eval()'.
+#		Regexp is generated from function names in util/regexp-assemble/data/933160.data
+#
+# - Rule 933151: ~1300 words of lesser importance. This includes most PHP functions and keywords.
+#		Examples: 'addslashes', 'array_diff'.
+#		For performance reasons, the @pmFromFile operator is used, and many functions from lesser
+#		used PHP extensions are removed.
+#		To mitigate false positives, we only match when the '(' character is also found.
+#		This rule only runs in paranoia level 2 or higher.
+#		Function names are defined in php-function-names-933151.data
+#
+# - Rule 933161: ~200 words with short or trivial names, possibly leading to false positives.
+#		Examples: 'abs', 'cos'.
+#		To mitigate false positives, a regexp matches on function syntax, e.g. 'abs()'.
+#		This rule only runs in paranoia level 3 or higher.
+#		Regexp is generated from function names in util/regexp-assemble/data/933161.data
+#
+
+
+#
+# [ PHP Functions: High-Risk PHP Function Names ]
+#
+# Rule 933150 contains a small list of function names which are highly indicative of a PHP
+# injection attack, for example 'base64_decode'.
+# We block these function names outright, without using a complex regexp or chain.
+# This could make the detection a bit more robust against possible bypasses.
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-function-names-933150.data" \
+    "id:933150,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: High-Risk PHP Function Name Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Functions: High-Risk PHP Function Calls ]
+#
+# Some PHP function names have a certain risk of false positives, due to short
+# names, full or partial overlap with common natural language terms, uses in
+# other contexts, et cetera. Some examples are 'eval', 'exec', 'system'.
+#
+# For these function names, we apply a regexp to look for PHP function syntax.
+# The regexp looks for a word boundary and adjoining parentheses.
+# For instance, we want to block 'eval()', but we want to allow 'medieval()'.
+#
+# We have to be careful of possible bypasses using comment syntax. Examples:
+#
+#   system(...)
+#   system (...)
+#   system\t(...)
+#   system /*comment*/ (...)
+#   system /*multiline \n comment*/ (...)
+#   system //comment \n (...)
+#   system #comment \n (...)
+#
+# This rule is also triggered by the following exploit(s):
+# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]
+# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ]
+# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
+#
+# Regular expression generated from regex-assembly/933160.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 933160
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b\(?[\"']*(?:a(?:rray_(?:(?:diff|intersect)_u(?:assoc|key)|filter|map|reduce|u(?:diff|intersect)(?:_u?assoc)?)|ssert(?:_options)?)|b(?:(?:ase64_en|son_(?:de|en))code|zopen)|c(?:hr|onvert_uuencode|reate_function|url_(?:exec|file_create|init))|(?:debug_backtrac|json_(?:de|en)cod|tmpfil)e|e(?:rror_reporting|scapeshell(?:arg|cmd)|val|x(?:ec|if_(?:imagetype|read_data|t(?:agname|humbnail))))|f(?:i(?:le(?:(?:_exist|perm)s|(?:[acm]tim|inod)e|group)?|nfo_open)|open|(?:pu|unction_exis)ts|tp_(?:connec|ge|nb_(?:ge|pu)|pu)t|write)|g(?:et(?:_(?:c(?:fg_va|urrent_use)r|meta_tags)|(?:cw|lastmo)d|env|imagesize|my(?:[gpu]id|inode))|lob|z(?:compress|(?:(?:defla|wri)t|encod|fil)e|open|read))|h(?:(?:ash_(?:(?:hmac|update)_)?|ighlight_)file|e(?:ader_register_callback|x2bin)|tml(?:_entity_decode|entities|specialchars(?:_decode)?))|i(?:mage(?:2?wbmp|createfrom(?:gif|(?:jpe|pn)g|wbmp|x[bp]m)|g(?:d2?|if)|(?:jpe|pn)g|xbm)|ni_(?:get(?:_all)?|set)|ptcembed|s_(?:dir|(?:(?:execut|read|write?)ab|fi)le)|terator_apply)|m(?:b_(?:ereg(?:_(?:match|replace(?:_callback)?)|i(?:_replace)?)?|parse_str)|(?:d5|ove_uploaded)_file|ethod_exists|kdir|ysql_query)|o(?:b_(?:clean|end_(?:clean|flush)|flush|get_(?:c(?:lean|ontents)|flush)|start)|dbc_(?:connect|exec(?:ute)?|result(?:_all)?)|pendir)|p(?:a(?:rse_(?:ini_file|str)|ssthru)|g_(?:connect|(?:execut|prepar)e|query)|hp(?:_(?:strip_whitespac|unam)e|info|version)|o(?:pen|six_(?:get(?:(?:e[gu]|g)id|login|pwnam)|kill|mk(?:fifo|nod)|ttyname))|r(?:eg_(?:match(?:_all)?|replace(?:_callback(?:_array)?)?|split)|int_r|oc_(?:(?:clos|nic|terminat)e|get_status|open))|utenv)|r(?:awurl(?:de|en)code|e(?:ad(?:_exif_data|dir|(?:gz)?file)|(?:gister_(?:shutdown|tick)|name)_function)|unkit_(?:constant_(?:add|redefine)|(?:function|method)_(?:add|copy|re(?:defin|nam)e)))|s(?:e(?:ssion_s(?:et_save_handler|tart)|t(?:_(?:e(?:rror|xception)_handler|include_path|magic_quotes_runtime)|defaultstub))|h(?:a1_fil|ow_sourc)e|implexml_load_(?:file|string)|ocket_c(?:onnect|reate)|pl_autoload_register|qlite_(?:(?:(?:array|single|unbuffered)_)?query|create_(?:aggregate|function)|exec|p?open)|tr(?:eam_(?:context_create|socket_client)|ipc?slashes|rev)|ystem)|u(?:[ak]?sort|n(?:pack|serialize)|rl(?:de|en)code)|var_dump)(?:/(?:\*.*\*/|/.*)|#.*[\s\v]|\")*[\"']*\)?[\s\v]*\(.*\)" \
+    "id:933160,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: High-Risk PHP Function Call Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Object Injection ]
+#
+# PHP Object Injection is an application level vulnerability that could allow
+# an attacker to perform different kinds of malicious attacks, such as
+# Code Injection, SQL Injection, Path Traversal and Application Denial of Service,
+# depending on the context.
+#
+# The vulnerability occurs when user-supplied input is not properly sanitized
+# before being passed to the unserialize() PHP function. Since PHP allows object
+# serialization, attackers could pass ad-hoc serialized strings to a vulnerable
+# unserialize() call, resulting in an arbitrary PHP object(s) injection into the
+# application scope.
+#
+# https://www.owasp.org/index.php/PHP_Object_Injection
+#
+# In serialized form, PHP objects have the following format:
+#
+#    O:8:"stdClass":1:{s:1:"a";i:2;}
+#    O:3:"Foo":0:{}
+#
+# Also detected are PHP objects with a custom unserializer:
+# http://www.phpinternalsbook.com/classes_objects/serialization.html
+# These have the following format:
+#
+#    C:11:"ArrayObject":37:{x:i:0;a:1:{s:1:"a";s:1:"b";};m:a:0:{}}
+#    C:3:"Foo":23:{s:15:"My private data";}
+#
+# HTTP headers are inspected, since PHP object injection vulnerabilities have been
+# found in applications parsing them:
+# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8562 (User-Agent header)
+# https://www.exploit-db.com/exploits/39033/ (X-Forwarded-For header)
+# http://karmainsecurity.com/KIS-2015-10 (Host header)
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|ARGS_NAMES|ARGS|XML:/* "@rx [oOcC]:\d+:\".+?\":\d+:{.*}" \
+    "id:933170,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: Serialized Object Injection',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+#
+# [ PHP Functions: Variable Function Calls ]
+#
+# PHP 'variable functions' provide an alternate syntax for calling PHP functions.
+# http://php.net/manual/en/functions.variable-functions.php
+#
+# An attacker may use variable function syntax to evade detection of function
+# names during exploitation of a remote code execution vulnerability.
+# An example to use the 'file_get_contents' function while evading rule 933150:
+#
+#   $fn = 'file_' . 'get_' . 'contents';
+#   echo $fn('wp-co' . 'nfig.php');
+#
+# Some examples from obfuscated malware:
+#
+#   $OOO0000O0(...)
+#   @$b374k(...)
+#   $_[@-_]($_[@!+_] )
+#
+# A breakdown of the regular expression:
+#
+#   \$+
+#       The variable's '$' char, or multiple '$' for 'variable variables':
+#       http://php.net/manual/en/language.variables.variable.php
+#   (?:[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*|\s*{.+})
+#       One of the following:
+#       - A variable name; regexp from http://php.net/language.variables.basics
+#       - A nonempty expression for variable variables: ${'fn'} or $ {'fn'}
+#   (?:\s|\[.+\]|{.+}|/\*.*\*/|//.*|#.*)*
+#       Optional whitespace, array access, or comments
+#   \(.*\)
+#       Parentheses optionally containing function parameters
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx \$+(?:[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*|\s*{.+})(?:\s|\[.+\]|{.+}|/\*.*\*/|//.*|#.*)*\(.*\)" \
+    "id:933180,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: Variable Function Call Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# [ PHP Functions: Variable Function Prevent Bypass ]
+#
+# Referring to https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/
+# Regex test on https://regex101.com/r/x1tfXG/1
+# the rule 933180 could be bypassed by using the following payloads:
+#
+# - (system)('uname');
+# - (sy.(st).em)('uname');
+# - (string)"system"('uname');
+# - define('x', 'sys' . 'tem');(x)/* comment */('uname');
+# - $y = 'sys'.'tem';($y)('uname');
+# - define('z', [['sys' .'tem']]);(z)[0][0]('uname');
+# - (system)(ls);
+# - (/**/system)(ls/**/);
+# - (['system'])[0]('uname');
+# - (++[++system++][++0++])++{/*dsasd*/0}++(++ls++);
+#
+# This rule blocks all payloads above and avoids to block values like:
+#
+# - [ACME] this is a test (just a test)
+# - Test (with two) rounded (brackets)
+#
+# Regular expression generated from regex-assembly/933210.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 933210
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?:\((?:.+\)(?:[\"'][\-0-9A-Z_a-z]+[\"'])?\(.+|[^\)]*string[^\)]*\)[\s\v\"'\--\.0-9A-\[\]_a-\{\}]+\([^\)]*)|(?:\[[0-9]+\]|\{[0-9]+\}|\$[^\(-\),\.-/;\x5c]+|[\"'][\-0-9A-Z\x5c_a-z]+[\"'])\(.+)\);" \
+    "id:933210,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecode,t:replaceComments,t:removeWhitespace,\
+    msg:'PHP Injection Attack: Variable Function Call Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:933013,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:933014,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+#
+# [ PHP Functions: Medium-Risk PHP Function Names ]
+#
+# In paranoia level 2, we add additional checks for most PHP functions.
+#
+# The size of the PHP function list is considerable.
+# Even after excluding the more obscure PHP extensions, 1300+ functions remain.
+# For performance and maintenance reasons, this rule does not use a regexp,
+# but uses a phrase file (@pmFromFile), and additionally looks for an '(' character
+# in the matched variable.
+#
+# This approach carries some risk for false positives. Therefore, the function list
+# has been curated to remove words closely matching natural language and terms often
+# used in other contexts.
+#
+# This rule is a stricter sibling of rule 933150.
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-function-names-933151.data" \
+    "id:933151,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: Medium-Risk PHP Function Name Found',\
+    logdata:'Matched Data: %{TX.933151_TX_0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.933151_tx_0=%{tx.0}',\
+    chain"
+    SecRule MATCHED_VARS "@pm (" \
+        "capture,\
+        setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:933015,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:933016,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+#
+# [ PHP Variables: Common Variable Indexes ]
+#
+# In paranoia level 3, we add additional checks for parameters to many PHP variables.
+#
+#
+# One of the more common variables used within attacks on PHP is $_SERVER. Because
+# of how many different ways PHP has for executing variables (variable variables,
+# etc) often just looking for $_SERVER will be less effective than looking for the
+# various indexes within $_SERVER. This rule checks for these indexes.
+# This rule is located in PL 3 because often developers will use these names as
+# parameter names or values and this will lead to false positives.
+# Because this list is not expected to change and it is limited in size we use a
+# regex in this case to look for these values whereas in its sibling rule we use
+# @pmFromFile for flexibility and performance.
+#
+# Regular expression generated from regex-assembly/933131.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 933131
+#
+# This rule is a stricter sibling of rule 933130.
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI" \
+    "id:933131,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:normalisePath,t:urlDecodeUni,\
+    msg:'PHP Injection Attack: Variables Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Functions: Low-Value PHP Function Calls ]
+#
+# In paranoia level 3, we add additional checks for the remaining PHP functions.
+#
+# Most of these function names are likely to cause false positives in natural text
+# or common parameter values, such as 'abs', 'copy', 'date', 'key', 'max', 'min'.
+# Therefore, these function names are not scanned in lower paranoia levels.
+#
+# To mitigate the risk of false positives somewhat, a regexp is used to look for
+# PHP function syntax. (See rule 933160 for a description.)
+#
+# This rule is a stricter sibling of rule 933160.
+#
+# This rule is also triggered by the following exploit(s):
+# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ]
+# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
+#
+# Regular expression generated from regex-assembly/933161.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 933161
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b(?:a(?:bs|cosh?|r(?:ray|sort)|s(?:inh?|(?:o|se)rt)|tan[2h]?)|b(?:asename|indec)|c(?:eil|h(?:dir|eckdate|mod|o(?:p|wn)|root)|lose(?:dir|log)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|(?:ryp|urren)t)|d(?:ate|e(?:coct|fined?)|i(?:(?:skfreespac)?e|r(?:name)?)|(?:oubleva)?l)|e(?:a(?:ch|ster_da(?:te|ys))|cho|mpty|nd|r(?:egi?|ror_log)|x(?:(?:i|trac)t|p(?:lode)?))|f(?:close|eof|gets|ile(?:owner|pro|(?:siz|typ)e)|l(?:o(?:atval|ck|or)|ush)|(?:mo|rea)d|stat|t(?:ell|ok)|unction)|g(?:et(?:date|t(?:ext|ype))|mdate)|h(?:ash|e(?:ader(?:s_(?:lis|sen)t)?|brev)|ypot)|i(?:conv|(?:dat|mplod)e|n(?:(?:clud|vok)e|t(?:div|val))|s(?:_(?:a(?:rray)?|bool|(?:calla|dou)ble|f(?:inite|loat)|in(?:finite|t(?:eger)?)|l(?:ink|ong)|n(?:an|u(?:ll|meric))|object|re(?:al|source)|s(?:calar|tring))|set))|join|k(?:ey|sort)|l(?:(?:cfirs|sta)t|evenshtein|i(?:nk(?:info)?|st)|o(?:caltime|g(?:1[0p])?)|trim)|m(?:a(?:i[ln]|x)|b(?:ereg|split)|etaphone|hash|i(?:crotime|n)|y?sql)|n(?:atsor|ex)t|o(?:ctdec|penlog|rd)|p(?:a(?:ck|thinfo)|close|i|o[sw]|r(?:ev|intf?))|quotemeta|r(?:an(?:d|ge)|e(?:adlin[ek]|(?:cod|nam|quir)e|set|wind)|ound|sort|trim)|s(?:(?:candi|ubst)r|(?:e(?:rializ|ttyp)|huffl)e|i(?:milar_text|nh?|zeof)|leep|o(?:rt|undex)|p(?:liti?|rintf)|qrt|rand|t(?:at|r(?:coll|(?:le|sp)n))|y(?:mlink|slog))|t(?:a(?:int|nh?)|e(?:mpnam|xtdomain)|ime|ouch|rim)|u(?:cfirst|mask|n(?:iqid|link|(?:se|tain)t)|s(?:leep|ort))|virtual|wordwrap)(?:[\s\v]|/(?:\*.*\*/|/.*)|#.*)*\(.*\)" \
+    "id:933161,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Injection Attack: Low-Value PHP Function Call Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ PHP Script Uploads: Superfluous extension ]
+#
+# Block file uploads with PHP related extensions (.php, .phps, .phtml,
+# .php5 etc) anywhere in the name, followed by a dot.
+#
+# Example: index.php.tmp
+#
+# Uploading of such files can lead to remote code execution if
+# Apache is configured with AddType and MultiViews, as Apache will
+# automatically do a filename match when the extension is unknown.
+# This configuration is fortunately not common in modern installs.
+#
+# Blocking these file names might lead to more false positives.
+#
+# Some AJAX uploaders use the nonstandard request headers X-Filename,
+# X_Filename, or X-File-Name to transmit the file name to the server;
+# scan these request headers as well as multipart/form-data file names.
+#
+# This rule is a stricter sibling of rule 933110.
+#
+SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:php\d*|phtml)\..*$" \
+    "id:933111,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'PHP Injection Attack: PHP Script File Upload Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+# [ PHP Closing Tag Found ]
+#
+# http://www.php.net/manual/en/language.basic-syntax.phptags.php
+#
+# This check was extracted from 933100 (paranoia level 1), since the
+# checked sequence '?>' commonly causes false positives.
+# See issue #654 for discussion.
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pm ?>" \
+    "id:933190,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,\
+    msg:'PHP Injection Attack: PHP Closing Tag Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+# [ PHP Functions: Variable Function Prevent Bypass ]
+#
+# This rule is a stricter sibling of 933210.
+# Unlike 933210, this rule will also match "this is a 'dog' (not a cat)", because the semi-colon at the end of the string is optional.
+# This is useful for PHP evals where the semi-colon is already hardcoded:
+# <?php eval("($input);") ?>
+#
+# Any potential function calls not at the end of a string will require a semi-colon to form valid PHP, which is automatically covered by 933210.
+#
+# Regular expression generated from regex-assembly/933211.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 933211
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?:\((?:.+\)(?:[\"'][\-0-9A-Z_a-z]+[\"'])?\(.+|[^\)]*string[^\)]*\)[\s\v\"'\--\.0-9A-\[\]_a-\{\}]+\([^\)]*)|(?:\[[0-9]+\]|\{[0-9]+\}|\$[^\(-\),\.-/;\x5c]+|[\"'][\-0-9A-Z\x5c_a-z]+[\"'])\(.+)\)(?:;|$)?" \
+    "id:933211,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecode,t:replaceComments,t:removeWhitespace,\
+    msg:'PHP Injection Attack: Variable Function Call Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-injection-php',\
+    tag:'paranoia-level/3',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:933017,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:933018,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-933-APPLICATION-ATTACK-PHP"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf

@@ -0,0 +1,388 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:934011,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:934012,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+
+# [ NodeJS Insecure unserialization / generic RCE signatures ]
+#
+# Libraries performing insecure unserialization:
+# - node-serialize: _$$ND_FUNC$$_ (CVE-2017-5941)
+# - funcster: __js_function
+#
+# See:
+# https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
+# https://www.acunetix.com/blog/web-security-zone/deserialization-vulnerabilities-attacking-deserialization-in-js/
+#
+# Some generic snippets used:
+# - function() {
+# - new Function(
+# - eval(
+# - String.fromCharCode(
+#
+# Last two are used by nodejsshell.py,
+# https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py
+#
+# As base64 is sometimes (but not always) used to encode serialized values,
+# use multiMatch and t:base64decode.
+#
+# Regular expression generated from regex-assembly/934100.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 934100
+#
+# Stricter sibling: 934101
+SecRule REQUEST_FILENAME|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx _(?:\$\$ND_FUNC\$\$_|_js_function)|(?:\beval|new[\s\v]+Function[\s\v]*)\(|String\.fromCharCode|function\(\)\{|this\.constructor|module\.exports=|\([\s\v]*[^0-9A-Z_a-z]child_process[^0-9A-Z_a-z][\s\v]*\)|process(?:\.(?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?(?:\.call)?\(|binding|constructor|env|global|main(?:Module)?|process|require)|\[[\"'`](?:(?:a(?:ccess|ppendfile|rgv|vailability)|c(?:aveats|h(?:mod|own)|(?:los|opyfil)e|p|reate(?:read|write)stream)|ex(?:ec(?:file)?|ists)|f(?:ch(?:mod|own)|data(?:sync)?|s(?:tat|ync)|utimes)|inodes|l(?:chmod|ink|stat|utimes)|mkd(?:ir|temp)|open(?:dir)?|r(?:e(?:ad(?:dir|file|link|v)?|name)|m)|s(?:pawn(?:file)?|tat|ymlink)|truncate|u(?:n(?:link|watchfile)|times)|w(?:atchfile|rite(?:file|v)?))(?:sync)?|binding|constructor|env|global|main(?:Module)?|process|require)[\"'`]\])|(?:binding|constructor|env|global|main(?:Module)?|process|require)\[|console(?:\.(?:debug|error|info|trace|warn)(?:\.call)?\(|\[[\"'`](?:debug|error|info|trace|warn)[\"'`]\])|require(?:\.(?:resolve(?:\.call)?\(|main|extensions|cache)|\[[\"'`](?:(?:resolv|cach)e|main|extensions)[\"'`]\])" \
+    "id:934100,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,t:jsDecode,t:removeWhitespace,t:base64Decode,\
+    msg:'Node.js Injection Attack 1/2',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-javascript',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    multiMatch,\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule REQUEST_FILENAME|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:close|exists|fork|(?:ope|spaw)n|re(?:ad|quire)|w(?:atch|rite))[\s\v]*\(" \
+    "id:934101,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,t:base64Decode,\
+    msg:'Node.js Injection Attack 2/2',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-javascript',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    multiMatch,\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# -=[ SSRF Attacks ]=-
+#
+# We provide only partial protection to SSRF. DNS Rebinding attacks needs
+# to be handled at application level, and even those might be difficult to catch.
+#
+# PL1 rules are based on common attacks on cloud providers, based on well-known URLs.
+#
+# -=[ References ]=-
+# https://highon.coffee/blog/ssrf-cheat-sheet/
+# https://cwe.mitre.org/data/definitions/918.html
+# https://capec.mitre.org/data/definitions/664.html)
+#
+# Preventing: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmFromFile ssrf.data" \
+    "id:934110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Possible Server Side Request Forgery (SSRF) Attack: Cloud provider metadata URL in Parameter',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-ssrf',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/664',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# JavaScript prototype pollution injection attempts
+#
+# Example from https://hackerone.com/reports/869574 critical
+# vulnerability in the TypeORM library:
+# {"text":"a","title":{"__proto__":{"where":{"name":"sqlinjection","where":null}}}}
+#
+# Test cases are based on this list of payloads:
+# https://github.com/BlackFan/client-side-prototype-pollution/blob/master/README.md
+#
+# See also: https://cwe.mitre.org/data/definitions/1321.html
+#
+# Note: only server-based (not DOM-based) attacks are covered here.
+# Stricter sibling: 934131
+
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:__proto__|constructor\s*(?:\.|\[)\s*prototype)" \
+    "id:934130,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,t:base64Decode,\
+    msg:'JavaScript Prototype Pollution',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-javascript',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1/180/77',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    multiMatch,\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# [ Ruby generic RCE signatures ]
+#
+# Detects Ruby-based injection attacks.
+# Example: Process.spawn("id")
+#
+# Regular expression generated from regex-assembly/934150.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 934150
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx Process[\s\v]*\.[\s\v]*spawn[\s\v]*\(" \
+    "id:934150,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Ruby Injection Attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-ruby',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# [ NodeJS DoS signatures ]
+#
+# NodeJS runs in a single thread, so any evaluated payloads that block execution can cause an easy DoS.
+# This rule attempts to block e.g. while(true).
+#
+# Regular expression generated from regex-assembly/934160.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 934160
+#
+SecRule REQUEST_FILENAME|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx while[\s\v]*\([\s\v\(]*(?:!+(?:false|null|undefined|NaN|[\+\-]?0|\"{2}|'{2}|`{2})|(?:!!)*(?:(?:t(?:rue|his)|[\+\-]?(?:Infinity|[1-9][0-9]*)|new [A-Za-z][0-9A-Z_a-z]*|window|String|(?:Boolea|Functio)n|Object|Array)\b|\{.*\}|\[.*\]|\"[^\"]+\"|'[^']+'|`[^`]+`)).*\)" \
+    "id:934160,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,t:base64Decode,t:replaceComments,\
+    msg:'Node.js DoS attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-javascript',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    multiMatch,\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# [ PHP data: scheme ]
+#
+# PHP supports the `data:` scheme without using `//` before the content-type.
+#
+# Regular expression generated from regex-assembly/934170.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 934170
+#
+SecRule REQUEST_FILENAME|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx ^data:(?:(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)/(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)|\*)(?:[\s\v]*;[\s\v]*(?:charset[\s\v]*=[\s\v]*\"?(?:iso-8859-15?|utf-8|windows-1252)\b\"?|(?:[^\s\v -\"\(-\),/:-\?\[-\]c\{\}]|c(?:[^!-\"\(-\),/:-\?\[-\]h\{\}]|h(?:[^!-\"\(-\),/:-\?\[-\]a\{\}]|a(?:[^!-\"\(-\),/:-\?\[-\]r\{\}]|r(?:[^!-\"\(-\),/:-\?\[-\]s\{\}]|s(?:[^!-\"\(-\),/:-\?\[-\]e\{\}]|e[^!-\"\(-\),/:-\?\[-\]t\{\}]))))))[^!-\"\(-\),/:-\?\[-\]\{\}]*[\s\v]*=[\s\v]*[^!\(-\),/:-\?\[-\]\{\}]+);?)*(?:[\s\v]*,[\s\v]*(?:(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)/(?:\*|[^!-\"\(-\),/:-\?\[-\]\{\}]+)|\*)(?:[\s\v]*;[\s\v]*(?:charset[\s\v]*=[\s\v]*\"?(?:iso-8859-15?|utf-8|windows-1252)\b\"?|(?:[^\s\v -\"\(-\),/:-\?\[-\]c\{\}]|c(?:[^!-\"\(-\),/:-\?\[-\]h\{\}]|h(?:[^!-\"\(-\),/:-\?\[-\]a\{\}]|a(?:[^!-\"\(-\),/:-\?\[-\]r\{\}]|r(?:[^!-\"\(-\),/:-\?\[-\]s\{\}]|s(?:[^!-\"\(-\),/:-\?\[-\]e\{\}]|e[^!-\"\(-\),/:-\?\[-\]t\{\}]))))))[^!-\"\(-\),/:-\?\[-\]\{\}]*[\s\v]*=[\s\v]*[^!\(-\),/:-\?\[-\]\{\}]+);?)*)*" \
+    "id:934170,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,\
+    msg:'PHP data scheme attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-ssrf',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:934013,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:934014,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+# -=[ SSRF Attacks ]=-
+#
+# PL2 rules adds SSRF capture for common evasion techniques.
+#
+# We add captures for these evasion techniques: (see source in util/regexp-assemble/data/regexp-934120.data)
+# http://425.510.425.510/ Dotted decimal with overflow (already covered by RFI rule 931100)
+# http://2852039166/ Dotless decimal - \d{10}
+# http://7147006462/ Dotless decimal with overflow - \d{10}
+# http://0xA9.0xFE.0xA9.0xFE/ Dotted hexadecimal - (?:0x[a-f0-9]{2}\.){3}0x[a-f0-9]{2}
+# http://0xA9FEA9FE/ Dotless hexadecimal - 0x[a-f0-9]{8}
+# http://0x41414141A9FEA9FE/ Dotless hexadecimal with overflow - 0x[a-f0-9]{16}
+# http://0251.0376.0251.0376/ Dotted octal - Covered by the same below
+# http://0251.00376.000251.0000376/ Dotted octal with padding - (?:0{1,4}\d{3}\.){3}0{1,4}\d{3})
+# http://169.254.43518/ - (?:\d{1,3}\.){2}\.\d{5}
+# http://169.16689662/ - \d{1,3}\.\d{8}
+# http://[::ffff:a9fe:a9fe] IPV6 Compressed - IPv6 regex from https://ihateregex.io/expr/ipv6/, with [0-9] converted to \d and with non-capturing groups (below)
+# http://[0:0:0:0:0:ffff:a9fe:a9fe] IPV6 Expanded -  (?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}\d){0,1}\d)\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}\d){0,1}\d)|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(2[0-4]|1{0,1}\d){0,1}\d)\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}\d){0,1}\d))
+# http://[0:0:0:0:0:ffff:169.254.169.254] IPV6/IPV4 - ((?:[0-9a-fA-F]{1,4}:){6}(?:(25[0-5]|(?:2[0-4]|1{0,1}\d){0,1}\d)\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}\d){0,1}\d))
+# http://[::]
+# http://127.88.23.245:22/+&@google.com:80#+@google.com:80/ (already covered by RFI rule 931100)
+# http://127.88.23.245:22/?@google.com:80/ (already covered by RFI rule 931100)
+# http://127.88.23.245:22/#@www.google.com:80/ (already covered by RFI rule 931100)
+# http://google.com:80\\@127.88.23.245:22/ (already covered by RFI rule 931100)
+# http://google.com:80+&@127.88.23.245:22/#+@google.com:80/
+# http://google.com:80+&@google.com:80#+@127.88.23.245:22/
+#
+# Regular expression generated from regex-assembly/934120.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 934120
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}\.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}\.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}\.(?:[0-9]{1,3}\.[0-9]{5}|[0-9]{8})|(?:\x5c\x5c[\-0-9a-z]\.?_?)+|\[[0-:a-f]+(?:[\.0-9]+|%[0-9A-Z_a-z]+)?\]|[a-z][\--\.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[\s\v]*&?@(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}|[a-z][\--\.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[\.0-9]{0,11}(?:\xe2(?:\x91[\xa0-\xbf]|\x92[\x80-\xbf]|\x93[\x80-\xa9\xab-\xbf])|\xe3\x80\x82)+))" \
+    "id:934120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Possible Server Side Request Forgery (SSRF) Attack: URL Parameter using IP Address',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-ssrf',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/664',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx \[\s*constructor\s*\]" \
+    "id:934131,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,t:base64Decode,\
+    msg:'JavaScript Prototype Pollution',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-javascript',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    multiMatch,\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+# [ Perl generic RCE signatures ]
+#
+# Detects Perl-based injection attacks.
+# Example: @{[system whoami]}
+#
+# Regular expression generated from regex-assembly/934140.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 934140
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx @\{.*\}" \
+    "id:934140,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Perl Injection Attack',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-perl',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'attack-injection-generic',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:934015,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:934016,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:934017,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:934018,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-GENERIC"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-934-APPLICATION-ATTACK-GENERIC"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf

@@ -0,0 +1,130 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943011,phase:1,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943012,phase:2,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# Session fixation
+#
+# -=[ References ]=-
+# http://projects.webappsec.org/Session-Fixation
+# http://projects.webappsec.org/w/page/13246960/Session%20Fixation
+# http://capec.mitre.org/data/definitions/61.html
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" \
+    "id:943100,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,\
+    msg:'Possible Session Fixation Attack: Setting Cookie Values in HTML',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-fixation',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/21/593/61',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" \
+    "id:943110,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-fixation',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/21/593/61',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule REQUEST_HEADERS:Referer "@rx ^(?:ht|f)tps?://(.*?)/" \
+        "capture,\
+        chain"
+        SecRule TX:1 "!@endsWith %{request_headers.host}" \
+            "setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\
+            setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" \
+    "id:943120,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Possible Session Fixation Attack: SessionID Parameter Name with No Referer',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-fixation',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/21/593/61',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule &REQUEST_HEADERS:Referer "@eq 0" \
+        "setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:943013,phase:1,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:943014,phase:2,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:943015,phase:1,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:943016,phase:2,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:943017,phase:1,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:943018,phase:2,pass,nolog,skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf

@@ -0,0 +1,465 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+# Many rules check request bodies, use "SecRequestBodyAccess On" to enable it on main modsecurity configuration file.
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944011,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944012,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+# This rule is also triggered by an Apache Struts exploit:
+# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ]
+#
+# This rule is also triggered by an Apache Struts Remote Code Execution exploit:
+# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]
+#
+# This rule is also triggered by an Apache Struts Remote Code Execution exploit:
+# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]
+#
+# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit:
+# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]
+#
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx java\.lang\.(?:runtime|processbuilder)" \
+    "id:944100,\
+    phase:2,\
+    block,\
+    t:none,t:lowercase,\
+    msg:'Remote Command Execution: Suspicious Java class detected',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/6',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# This rule is also triggered by the following exploit(s):
+# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ]
+# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]
+# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]
+# [ Java deserialization vulnerability/Apache Struts (CVE-2017-9805) ]
+# [ Java deserialization vulnerability/Oracle Weblogic (CVE-2017-10271) ]
+# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
+#
+# Generic rule to detect processbuilder or runtime calls, if any of those is found and the same target contains
+# java. unmarshaller or base64data to trigger a potential payload execution
+# tested with https://www.exploit-db.com/exploits/42627/ and https://www.exploit-db.com/exploits/43458/
+
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx (?:runtime|processbuilder)" \
+    "id:944110,\
+    phase:2,\
+    block,\
+    t:none,t:lowercase,\
+    msg:'Remote Command Execution: Java process spawn (CVE-2017-9805)',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?:unmarshaller|base64data|java\.)" \
+        "setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Magic bytes detected and payload included possibly RCE vulnerable classes detected and process execution methods detected
+# anomaly score set to critical as all conditions indicate the request try to perform RCE.
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
+    "id:944120,\
+    phase:2,\
+    block,\
+    t:none,t:lowercase,\
+    msg:'Remote Command Execution: Java serialization (CVE-2015-4852)',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    chain"
+    SecRule MATCHED_VARS "@rx (?:runtime|processbuilder)" \
+        "setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# This rule is also triggered by the following exploit(s):
+# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/mazen160/struts-pwn ]
+# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ]
+# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ]
+# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ]
+# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]
+# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ]
+# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ]
+#
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@pmFromFile java-classes.data" \
+    "id:944130,\
+    phase:2,\
+    block,\
+    t:none,\
+    msg:'Suspicious Java class detected',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+#
+# [ Java Script Uploads ]
+#
+# Block file uploads with filenames ending in Java scripts (.jsp, .jspx)
+#
+# Many application contain Unrestricted File Upload vulnerabilities.
+# https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
+#
+# Attackers may use such a vulnerability to achieve remote code execution
+# by uploading a script file. If the upload storage location is predictable
+# and not adequately protected, the attacker may then request the uploaded
+# file and have the code within it executed on the server.
+#
+# Some AJAX uploaders use the nonstandard request headers X-Filename,
+# X_Filename, or X-File-Name to transmit the file name to the server;
+# scan these request headers as well as multipart/form-data file names.
+#
+SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:jsp|jspx)\.*$" \
+    "id:944140,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Java Injection Attack: Java Script File Upload Found',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-injection-java',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/242',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+# Log4J / Log4Shell Defense
+#
+# This addresses exploits against the Log4J library described in several CVEs:
+# * CVE-2021-44228
+# * CVE-2021-44832
+# * CVE-2021-45046
+# * CVE-2021-45105
+#
+# See https://coreruleset.org/20211213/crs-and-log4j-log4shell-cve-2021-44228/
+#
+# This rule attempts to detect two things:
+# * Nested use of ${
+# * use of ${jndi:... without the closing bracket
+#
+# Rule 932130 is also essential for defense since there are certain
+# bypasses of the log4j rules that can be caught by 932130.
+#
+# The payload is not displayed in the alert message since log4j could
+# potentially be executed on the logviewer.
+#
+# This rule has stricter siblings: 944151 (PL2), 944152 (PL4)
+#
+# Regular expression generated from regex-assembly/944150.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 944150
+#
+SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?i)(?:\$|$?)(?:\{|&l(?:brace|cub);?)(?:[^\}]{0,15}(?:\$|$?)(?:\{|&l(?:brace|cub);?)|jndi|ctx)" \
+    "id:944150,\
+    phase:2,\
+    block,\
+    t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,\
+    log,\
+    msg:'Potential Remote Command Execution: Log4j / Log4shell',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/6',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/1',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:944013,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:944014,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+# This is a stricter sibling of 944150.
+# It is a re-iteration of said rule without the curly bracket distance limiter
+# between the nested "${". This is prone to backtracking and therefore a potential
+# DoS problem for backtracking regular expression engines (e.g. PCRE2), but it also avoids evasions that fill the space between the nested
+# elements with arbitrary data.
+#
+# Regular expression generated from regex-assembly/944151.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 944151
+#
+SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?i)(?:\$|$?)(?:\{|&l(?:brace|cub);?)(?:[^\}]*(?:\$|$?)(?:\{|&l(?:brace|cub);?)|jndi|ctx)" \
+    "id:944151,\
+    phase:2,\
+    block,\
+    t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,\
+    log,\
+    msg:'Potential Remote Command Execution: Log4j / Log4shell',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/6',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+# [ Java deserialization vulnerability/Apache Commons (CVE-2015-4852) ]
+#
+# Detect exploitation of "Java deserialization" Apache Commons.
+#
+# Based on rules by @spartantri.
+# https://spartantri.com/ModSecurity/?p=44
+#
+# Interesting references about the vulnerability
+# https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
+# https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
+#
+# Potential false positives with random fields, the anomaly level is set low to avoid blocking request
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx \xac\xed\x00\x05" \
+    "id:944200,\
+    phase:2,\
+    block,\
+    msg:'Magic bytes Detected, probable java serialization in use',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+# Detecting possible base64 text to match encoded magic bytes \xac\xed\x00\x05 with padding encoded in base64 strings are rO0ABQ KztAAU Cs7QAF
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" \
+    "id:944210,\
+    phase:2,\
+    block,\
+    msg:'Magic bytes Detected Base64 Encoded, probable java serialization in use',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
+    "id:944240,\
+    phase:2,\
+    block,\
+    t:none,t:lowercase,\
+    msg:'Remote Command Execution: Java serialization (CVE-2015-4852)',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+# This rule is also triggered by the following exploit(s):
+# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
+#
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx java\b.+(?:runtime|processbuilder)" \
+    "id:944250,\
+    phase:2,\
+    block,\
+    t:lowercase,\
+    msg:'Remote Command Execution: Suspicious Java method detected',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+# This rule is also triggered by the following exploit(s):
+# - https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/
+# - https://www.ironcastle.net/possible-new-java-spring-framework-vulnerability-wed-mar-30th/
+#
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx (?:class\.module\.classLoader\.resources\.context\.parent\.pipeline|springframework\.context\.support\.FileSystemXmlApplicationContext)" \
+    "id:944260,\
+    phase:2,\
+    block,\
+    t:urlDecodeUni,\
+    msg:'Remote Command Execution: Malicious class-loading payload',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944015,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944016,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+# Interesting keywords for possibly RCE on vulnerable classes and methods base64 encoded
+# Keywords = ['runtime', 'processbuilder', 'clonetransformer', 'forclosure', 'instantiatefactory', 'instantiatetransformer', 'invokertransformer', 'prototypeclonefactory', 'prototypeserializationfactory', 'whileclosure']
+#for item in keywords:
+#   pad='\x00'
+#   for padding in xrange(3):
+#     print base64.b64encode(''.join([pad*padding,item])).replace('=','')[padding:],
+#cnVudGltZQ HJ1bnRpbWU BydW50aW1l cHJvY2Vzc2J1aWxkZXI HByb2Nlc3NidWlsZGVy Bwcm9jZXNzYnVpbGRlcg Y2xvbmV0cmFuc2Zvcm1lcg GNsb25ldHJhbnNmb3JtZXI BjbG9uZXRyYW5zZm9ybWVy Zm9yY2xvc3VyZQ GZvcmNsb3N1cmU Bmb3JjbG9zdXJl aW5zdGFudGlhdGVmYWN0b3J5 Gluc3RhbnRpYXRlZmFjdG9yeQ BpbnN0YW50aWF0ZWZhY3Rvcnk aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg Gluc3RhbnRpYXRldHJhbnNmb3JtZXI BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy aW52b2tlcnRyYW5zZm9ybWVy Gludm9rZXJ0cmFuc2Zvcm1lcg BpbnZva2VydHJhbnNmb3JtZXI cHJvdG90eXBlY2xvbmVmYWN0b3J5 HByb3RvdHlwZWNsb25lZmFjdG9yeQ Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5 Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ d2hpbGVjbG9zdXJl HdoaWxlY2xvc3VyZQ B3aGlsZWNsb3N1cmU
+SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
+    "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" \
+    "id:944300,\
+    phase:2,\
+    block,\
+    t:none,\
+    msg:'Base64 encoded string matched suspicious keyword',\
+    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/248',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/3',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:944017,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:944018,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+# This is a stricter sibling of 944150.
+# It simply checks for the existence of `${`, taking into account the same encoding evasions
+# as 944150.
+#
+# Regular expression generated from regex-assembly/944152.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 944152
+#
+SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?i)(?:\$|$?)(?:\{|&l(?:brace|cub);?)" \
+    "id:944152,\
+    phase:2,\
+    block,\
+    t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,\
+    log,\
+    msg:'Potential Remote Command Execution: Log4j / Log4shell',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152/137/6',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/4',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-944-APPLICATION-ATTACK-JAVA"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/REQUEST-949-BLOCKING-EVALUATION.conf

@@ -0,0 +1,221 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+# Summing up the blocking and detection anomaly scores in phase 1
+# even when early blocking is disabled, we need to sum up the scores in phase 1
+# this prevents bugs in phase 5 if Apache skips phases because of error handling
+# See: https://github.com/coreruleset/coreruleset/issues/2319#issuecomment-1047503932
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 1" \
+    "id:949052,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
+    "id:949152,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
+    "id:949053,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
+    "id:949153,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
+    "id:949054,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
+    "id:949154,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
+    "id:949055,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
+    "id:949155,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
+
+# at start of phase 2, we reset the aggregate scores to 0 to prevent duplicate counting of per-PL scores
+# this is necessary because the per-PL scores are counted across phases
+SecAction "id:949059,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=0'"
+SecAction "id:949159,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=0'"
+
+# Summing up the blocking and detection anomaly scores in phase 2
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 1" \
+    "id:949060,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
+    "id:949160,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
+    "id:949061,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
+    "id:949161,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
+    "id:949062,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
+    "id:949162,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
+
+SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
+    "id:949063,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
+    "id:949163,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
+
+
+SecMarker "BEGIN-REQUEST-BLOCKING-EVAL"
+
+#
+# -=[ Anomaly Mode: Overall Transaction Anomaly Score ]=-
+#
+
+# if early blocking is active, check threshold in phase 1
+SecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
+    "id:949111,\
+    phase:1,\
+    deny,\
+    t:none,\
+    msg:'Inbound Anomaly Score Exceeded in phase 1 (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})',\
+    tag:'anomaly-evaluation',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    chain"
+    SecRule TX:EARLY_BLOCKING "@eq 1"
+
+# always check threshold in phase 2
+SecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
+    "id:949110,\
+    phase:2,\
+    deny,\
+    t:none,\
+    msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})',\
+    tag:'anomaly-evaluation',\
+    ver:'OWASP_CRS/4.0.0-rc1'"
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:949011,phase:1,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:949012,phase:2,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:949013,phase:1,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:949014,phase:2,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:949015,phase:1,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:949016,phase:2,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:949017,phase:1,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:949018,phase:2,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-REQUEST-949-BLOCKING-EVALUATION"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/RESPONSE-950-DATA-LEAKAGES.conf

@@ -0,0 +1,134 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+# The paranoia level skip rules 950020, 950021 and 950022 have odd
+# numbers not in sync with other paranoia level skip rules in other
+# files. This is done to avoid rule id collisions with CRSv2.
+# This is also true for rule 950130.
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:950020,phase:3,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:950021,phase:4,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ Directory Listing ]=-
+#
+SecRule RESPONSE_BODY "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Index of|>\[To Parent Directory\]</[Aa]><br>)" \
+    "id:950130,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Directory Listing',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54/127',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+#
+# -=[ CGI Source Code Leakage ]=-
+#
+# A CGI script begins normally with #! and the interpreter,
+# for example:
+#
+# #!/usr/bin/perl
+# #!/usr/bin/python
+# #!/usr/bin/ruby
+#
+# If the CGI script processors or MIME type handlers are misconfigured,
+# the script's source code could be erroneously returned to the client.
+SecRule RESPONSE_BODY "@rx ^#\!\s?/" \
+    "id:950140,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'CGI source code leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:950013,phase:3,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:950014,phase:4,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+#
+# -=[ The application is not available - 5xx level status code ]=-
+#
+SecRule RESPONSE_STATUS "@rx ^5\d{2}$" \
+    "id:950100,\
+    phase:3,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'The Application Returned a 500-Level Status Code',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'PCI/6.5.6',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/152',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:950015,phase:3,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:950016,phase:4,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:950017,phase:3,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:950022,phase:4,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-RESPONSE-950-DATA-LEAKAGES"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf

@@ -0,0 +1,404 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:951011,phase:3,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:951012,phase:4,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ SQL Error Leakages ]=-
+#
+# Ref: https://raw.github.com/sqlmapproject/sqlmap/master/xml/errors.xml
+# Ref: https://github.com/Arachni/arachni/tree/master/components/checks/active/sql_injection/regexps
+#
+SecRule RESPONSE_BODY "!@pmFromFile sql-errors.data" \
+    "id:951100,\
+    phase:4,\
+    pass,\
+    t:none,\
+    nolog,\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    skipAfter:END-SQL-ERROR-MATCH-PL1"
+
+SecRule RESPONSE_BODY "@rx (?i:JET Database Engine|Access Database Engine|\[Microsoft\]\[ODBC Microsoft Access Driver\])" \
+    "id:951110,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Microsoft Access SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-msaccess',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java\.sql\.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" \
+    "id:951120,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Oracle SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-oracle',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:DB2 SQL error:|\[IBM\]\[CLI Driver\]\[DB2/6000\]|CLI Driver.*DB2|DB2 SQL error|db2_\w+\()" \
+    "id:951130,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'DB2 SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-db2',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:\[DM_QUERY_E_SYNTAX\]|has occurred in the vicinity of:)" \
+    "id:951140,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'EMC SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-emc',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i)Dynamic SQL Error" \
+    "id:951150,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'firebird SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-firebird',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i)Exception (?:condition )?\d+\. Transaction rollback\." \
+    "id:951160,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Frontbase SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-frontbase',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i)org\.hsqldb\.jdbc" \
+    "id:951170,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'hsqldb SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-hsqldb',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:An illegal character has been found in the statement|com\.informix\.jdbc|Exception.*Informix)" \
+    "id:951180,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'informix SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-informix',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|Ingres\W.*Driver)" \
+    "id:951190,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'ingres SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-ingres',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command in statement)" \
+    "id:951200,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'interbase SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-interbase',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)" \
+    "id:951210,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'maxDB SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-maxdb',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*\WSystem\.Data\.SqlClient\.)" \
+    "id:951220,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'mssql SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-mssql',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+# Regular expression generated from regex-assembly/951230.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 951230
+#
+SecRule RESPONSE_BODY "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\(\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\.)|\[MySQL\]\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\(-\)_a-z]{1,26})?|ERROR [0-9]{4} \([0-9a-z]{5}\):" \
+    "id:951230,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'mysql SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-mysql',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+# Regular expression generated from regex-assembly/951240.ra.
+# To update the regular expression run the following shell script
+# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
+#   crs-toolchain regex update 951240
+#
+SecRule RESPONSE_BODY "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[a-z]*Error)|pg_(?:query|exec)\(\) \[:|Warning.{1,20}\bpg_.*|valid PostgreSQL result|Npgsql\.|Supplied argument is not a valid PostgreSQL .*? resource|Unable to connect to PostgreSQL server" \
+    "id:951240,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'postgres SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-pgsql',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite\.Exception|System\.Data\.SQLite\.SQLiteException)" \
+    "id:951250,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'sqlite SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-sqlite',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*Server message.*)" \
+    "id:951260,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Sybase SQL Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-sybase',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116/54',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
+
+SecMarker "END-SQL-ERROR-MATCH-PL1"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:951013,phase:3,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:951014,phase:4,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:951015,phase:3,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:951016,phase:4,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:951017,phase:3,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:951018,phase:4,pass,nolog,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-RESPONSE-951-DATA-LEAKAGES-SQL"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf

@@ -0,0 +1,100 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952011,phase:3,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952012,phase:4,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ Java Source Code Leakages ]=-
+#
+SecRule RESPONSE_BODY "@pmFromFile java-code-leakages.data" \
+    "id:952100,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Java Source Code Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+#
+# -=[ Java Errors ]=-
+#
+# Ref: https://github.com/andresriancho/w3af/blob/master/w3af/plugins/grep/error_pages.py
+#
+SecRule RESPONSE_BODY "@pmFromFile java-errors.data" \
+    "id:952110,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Java Errors',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-java',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:952013,phase:3,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:952014,phase:4,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:952015,phase:3,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:952016,phase:4,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:952017,phase:3,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:952018,phase:4,pass,nolog,skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-RESPONSE-952-DATA-LEAKAGES-JAVA"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf

@@ -0,0 +1,150 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:953011,phase:3,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:953012,phase:4,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+#
+# -=[ PHP Error Message Leakage ]=-
+#
+SecRule RESPONSE_BODY "@pmFromFile php-errors.data" \
+    "id:953100,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+#
+# -=[ PHP source code leakage ]=-
+#
+# Detect some common PHP keywords in output.
+#
+SecRule RESPONSE_BODY "@rx (?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\$_(?:(?:pos|ge)t|session))\b" \
+    "id:953110,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP source code leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+# Detect the presence of the PHP open tag "<? ", "<?= " or "<?php " in output.
+#
+# To prevent false positives (due to the short "<?" sequences), we also include,
+# the space after it in an attempt to stop alerts in binary output.
+# And we make it case insensitive.
+#
+SecRule RESPONSE_BODY "@rx (?i)<\?(?:=|php)?\s+" \
+    "id:953120,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP source code leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:953013,phase:3,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:953014,phase:4,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+#
+# -=[ PHP Error Message Leakage ]=-
+#
+# This is a stricter sibling of rule 953100.
+# This stricter sibling checks for additional error messages which has a higher chance to appear in common language.
+#
+SecRule RESPONSE_BODY "@pmFromFile php-errors-pl2.data" \
+    "id:953101,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PHP Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'"
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:953015,phase:3,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:953016,phase:4,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:953017,phase:3,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:953018,phase:4,pass,nolog,skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-RESPONSE-953-DATA-LEAKAGES-PHP"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/RESPONSE-954-DATA-LEAKAGES-IIS.conf

@@ -0,0 +1,144 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:954011,phase:3,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:954012,phase:4,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+# IIS default location
+SecRule RESPONSE_BODY "@rx [a-z]:\x5cinetpub\b" \
+    "id:954100,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,t:lowercase,\
+    msg:'Disclosure of IIS install location',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-iis',\
+    tag:'platform-windows',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+SecRule RESPONSE_BODY "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| \(0x80040e31\)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error\.</h2>|cannot connect to the server: timed out)" \
+    "id:954110,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Application Availability Error',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-iis',\
+    tag:'platform-windows',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'PCI/6.5.6',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+#
+# IIS Errors leakage
+#
+SecRule RESPONSE_BODY "@pmFromFile iis-errors.data" \
+    "id:954120,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'IIS Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-iis',\
+    tag:'platform-windows',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+
+SecRule RESPONSE_STATUS "!@rx ^404$" \
+    "id:954130,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'IIS Information Leakage',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-iis',\
+    tag:'platform-windows',\
+    tag:'attack-disclosure',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/118/116',\
+    tag:'PCI/6.5.6',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'ERROR',\
+    chain"
+    SecRule RESPONSE_BODY "@rx \bServer Error in.{0,50}?\bApplication\b" \
+        "capture,\
+        t:none,\
+        setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:954013,phase:3,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:954014,phase:4,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:954015,phase:3,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:954016,phase:4,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:954017,phase:3,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:954018,phase:4,pass,nolog,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-RESPONSE-954-DATA-LEAKAGES-IIS"

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/RESPONSE-955-WEB-SHELLS.conf

@@ -0,0 +1,548 @@
+# ------------------------------------------------------------------------
+# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
+# Copyright (c) 2006-2020 Trustwave and contributors. (not) All rights reserved.
+# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
+#
+# The OWASP ModSecurity Core Rule Set is distributed under
+# Apache Software License (ASL) version 2
+# Please see the enclosed LICENSE file for full details.
+# ------------------------------------------------------------------------
+
+#
+# -= Paranoia Level 0 (empty) =- (apply unconditionally)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955011,phase:3,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955012,phase:4,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+#
+# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
+#
+
+# For performance reasons, most of the shells are matched using this rule.
+# This rule is intended for PHP web shells.
+SecRule RESPONSE_BODY "@pmFromFile web-shells-php.data" \
+    "id:955100,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Web shell detected',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# r57 web shell
+SecRule RESPONSE_BODY "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)" \
+    "id:955110,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'r57 web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# WSO web shell
+SecRule RESPONSE_BODY "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>" \
+    "id:955120,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'WSO web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# b4tm4n web shell (https://github.com/k4mpr3t/b4tm4n)
+SecRule RESPONSE_BODY "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>" \
+    "id:955130,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'b4tm4n web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Mini Shell web shell
+SecRule RESPONSE_BODY "@rx <title>Mini Shell</title>.*Developed By LameHacker" \
+    "id:955140,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Mini Shell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Ashiyane web shell
+SecRule RESPONSE_BODY "@rx <title>\.:: .* ~ Ashiyane V [0-9.]+ ::\.</title>" \
+    "id:955150,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Ashiyane web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Symlink_Sa web shell
+SecRule RESPONSE_BODY "@rx <title>Symlink_Sa [0-9.]+</title>" \
+    "id:955160,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Symlink_Sa web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# CasuS web shell
+SecRule RESPONSE_BODY "@rx <title>CasuS [0-9.]+ by MafiABoY</title>" \
+    "id:955170,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'CasuS web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# GRP WebShell
+SecRule RESPONSE_BODY "@rx ^<html>\r\n<head>\r\n<title>GRP WebShell [0-9.]+ " \
+    "id:955180,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'GRP WebShell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# NGHshell web shell
+SecRule RESPONSE_BODY "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>\n$" \
+    "id:955190,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'NGHshell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# SimAttacker web shell
+SecRule RESPONSE_BODY "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ - " \
+    "id:955200,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'SimAttacker web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Unknown web shell
+SecRule RESPONSE_BODY "@rx ^<!DOCTYPE html>\n<html>\n<!-- By Artyum .*<title>Web Shell</title>" \
+    "id:955210,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Unknown web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# lama's'hell web shell
+SecRule RESPONSE_BODY "@rx <title>lama's'hell v. [0-9.]+</title>" \
+    "id:955220,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'lama\'s\'hell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# lostDC web shell
+SecRule RESPONSE_BODY "@rx ^ *<html>\n[ ]+<head>\n[ ]+<title>lostDC - " \
+    "id:955230,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'lostDC web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Unknown web shell
+SecRule RESPONSE_BODY "@rx ^<title>PHP Web Shell</title>\r\n<html>\r\n<body>\r\n    <!-- Replaces command with Base64-encoded Data -->" \
+    "id:955240,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Unknown web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Unknown web shell
+SecRule RESPONSE_BODY "@rx ^<html>\n<head>\n<div align=\"left\"><font size=\"1\">Input command :</font></div>\n<form name=\"cmd\" method=\"POST\" enctype=\"multipart/form-data\">" \
+    "id:955250,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Unknown web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Ru24PostWebShell web shell
+SecRule RESPONSE_BODY "@rx ^<html>\n<head>\n<title>Ru24PostWebShell - " \
+    "id:955260,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Ru24PostWebShell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# s72 Shell web shell
+SecRule RESPONSE_BODY "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>" \
+    "id:955270,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'s72 Shell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# PhpSpy web shell
+SecRule RESPONSE_BODY "@rx ^<html>\r\n<head>\r\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\">\r\n<title>PhpSpy Ver [0-9]+</title>" \
+    "id:955280,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'PhpSpy web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# g00nshell web shell
+SecRule RESPONSE_BODY "@rx ^ <html>\n\n<head>\n\n<title>g00nshell v[0-9.]+ " \
+    "id:955290,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'g00nshell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# PuNkHoLic shell web shell
+# Various versions has this text written little differently so we need to do
+# t:removeWhitespace and t:lowercase.
+SecRule RESPONSE_BODY "@contains <title>punkholicshell</title>" \
+    "id:955300,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,t:removeWhitespace,t:lowercase,\
+    msg:'PuNkHoLic shell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# azrail web shell
+SecRule RESPONSE_BODY "@rx ^<html>\n      <head>\n             <title>azrail [0-9.]+ by C-W-M</title>" \
+    "id:955310,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'azrail web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# SmEvK_PaThAn Shell web shell
+SecRule RESPONSE_BODY "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=" \
+    "id:955320,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'SmEvK_PaThAn Shell web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# Shell I web shell
+SecRule RESPONSE_BODY "@rx ^<html>\n<title>.*? ~ Shell I</title>\n<head>\n<style>" \
+    "id:955330,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'Shell I web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+# b374k m1n1 web shell
+SecRule RESPONSE_BODY "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>" \
+    "id:955340,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'b374k m1n1 web shell',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/1',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955013,phase:3,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955014,phase:4,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+#
+# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
+#
+
+# webadmin.php file manager
+# This is placed in PL2 because of too generic pattern.
+SecRule RESPONSE_BODY "@contains <h1 style=\"margin-bottom: 0\">webadmin.php</h1>" \
+    "id:955350,\
+    phase:4,\
+    block,\
+    capture,\
+    t:none,\
+    msg:'webadmin.php file manager',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
+    tag:'language-php',\
+    tag:'platform-multi',\
+    tag:'attack-rce',\
+    tag:'paranoia-level/2',\
+    tag:'OWASP_CRS',\
+    tag:'capec/1000/225/122/17/650',\
+    ver:'OWASP_CRS/4.0.0-rc1',\
+    severity:'CRITICAL',\
+    setvar:'tx.outbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955015,phase:3,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955016,phase:4,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+#
+# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
+#
+
+
+
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955017,phase:3,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955018,phase:4,pass,nolog,skipAfter:END-RESPONSE-955-WEB-SHELLS"
+#
+# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
+#
+
+
+
+#
+# -= Paranoia Levels Finished =-
+#
+SecMarker "END-RESPONSE-955-WEB-SHELLS"